CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ai_get_table' function in all versions up to, and including, 1.0.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read all data in the wp_originalityai_log database table, which can include post titles, scan scores, credits used, and other data.
Explanation of Vulnerability in Simple Terms
Originality.ai AI Checker versions 1.0.16 and earlier lack proper authorization checks, allowing authenticated users to access sensitive information they should not be able to view. An attacker with a low-privilege account can read data belonging to other users or the system. The vulnerability requires valid login credentials but no additional user interaction.
What an attacker can do
Read sensitive data or information belonging to other users or the system.
Potential impact on your site
User data and system information may be exposed to any authenticated account holder, even those with minimal permissions.
Conditions required to exploit
Attacker must have a valid low-privilege account on the system.
Key dates
External resources
Related vulnerabilities
