What the vulnerability does
01Description
The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via deserialization of untrusted input from the $form['post_content'] variable through the wpaicg_export_ai_forms() function. This allows authenticated attackers, with administrative privileges, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Explanation of Vulnerability in Simple Terms
02Summary
The AI Puffer plugin for WordPress versions 1.8.96 and earlier contains a deserialization vulnerability in how it processes untrusted data. An authenticated administrator can exploit this to read sensitive site data, modify content, or disable the site. The vulnerability requires admin-level access and does not involve user interaction. Update to a version newer than 1.8.96 immediately.
What an attacker can do
03Attacker Capabilities
Read sensitive data, modify site content, or disable the site by submitting malicious serialized data.
Potential impact on your site
04Site Impact
An admin account compromise could lead to full site takeover, data theft, or service disruption.
Conditions required to exploit
05Prerequisites
Attacker must have WordPress administrator privileges; no user interaction required.
Key dates
06Disclosure timeline
January 22, 2025
CVE published
April 8, 2026
Record updated
