CVE-2025-0428
Last modified
CVE-2025-0428 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via deserialization of untrusted input from the $form['post_content'] variable through the wpaicg_export_prompts function. This allows authenticated attackers, with administrative privileges, to inject a PHP Object. EPSS estimates a 0.64% chance of exploitation in the next 30 days.
Description
The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via deserialization of untrusted input from the $form['post_content'] variable through the wpaicg_export_prompts function. This allows authenticated attackers, with administrative privileges, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Aipower | Aipower | < 1.8.97 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-0428?
How severe is CVE-2025-0428?
How do I fix CVE-2025-0428?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-0422An authenticated user in the "bestinformed Web" application …8.6
- CVE-2025-0423In the "bestinformed Web" application, some user input was n…5.3
- CVE-2025-0424In the "bestinformed Web" application, some user input was n…5.1
- CVE-2025-0425Via the GUI of the "bestinformed Infoclient", a low-privileg…8.5
- CVE-2025-0426A security issue was discovered in Kubernetes where a large …6.2
- CVE-2025-0427Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel D…7.8
- CVE-2025-0429The "AI Power: Complete AI Pack" plugin for WordPress is vul…7.2
- CVE-2025-0430Belledonne Communications Linphone-Desktop is vulnerable t…8.7
- CVE-2025-0431Enterprise Protection contains a vulnerability in URL rewrit…5.8
- CVE-2025-0432EWON Flexy 202 transmits user credentials in clear text with…6.9
- CVE-2025-0433The Master Addons – Elementor Addons with White Label, Free …5.4
- CVE-2025-0434Out of bounds memory access in V8 in Google Chrome prior to …8.8
Are you affected by CVE-2025-0428?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST