CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_post_data() function in versions 2.0.7 to 2.2.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create and publish arbitrary posts.
Explanation of Vulnerability in Simple Terms
The Ai Auto Tool Content Writing Assistant plugin versions 2.0.7 through 2.2.6 lack proper authorization checks on certain functions. A logged-in user with low privileges can modify data they should not have access to, such as other users' content or settings. The vulnerability does not expose sensitive information or cause service disruption, but allows unauthorized changes to site data.
What an attacker can do
Modify content or settings belonging to other users or the site without proper permission.
Potential impact on your site
Unauthorized users can alter posts, pages, or plugin settings, potentially defacing content or disrupting site functionality.
Conditions required to exploit
Attacker must have a low-privilege account on the site (e.g., subscriber or contributor role).
Key dates
External resources
