CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ai_scan_result_remove' function in all versions up to, and including, 1.0.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all data in the wp_originalityai_log database table, which can include post titles, scan scores, credits used, and other data.
Explanation of Vulnerability in Simple Terms
Originality.ai AI Checker versions up to 1.0.15 contain an integrity issue that allows authenticated users to modify data they should not have access to. The vulnerability requires a valid user account and network access but no additional user interaction. The impact is limited to data modification without affecting confidentiality or system availability.
What an attacker can do
Modify data within the application without authorization.
Potential impact on your site
Authenticated users can alter application data, potentially affecting content accuracy or system integrity.
Conditions required to exploit
Attacker must have a valid user account (low privilege level) and network access.
Key dates
External resources
Related vulnerabilities
