CVE-2025-10902

MediumCVSS 4.3

Published: 24/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the 'ai_scan_result_remove' function in all versions up to and including 1.0.15. This allows authenticated attackers with Subscriber-level access or above to delete all data in the wp_originalityai_log database table, including post titles, scan scores, credits used, and other data.

Risk Assessment

The risk involves potential deletion of critical historical scan data, leading to information loss and impacting audit and monetization features.

Recommendation

Update the plugin to a patched version and restrict user account privileges.

Other vulnerabilities in Originality.ai AI Checker

CVE-2025-10901Medium
The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ai_get_table' function in all versions up to and including 1.0.16. An authenticated attacker with Subscriber-level access and above can read all data in the wp_originalityai_log database table, which can include post titles, scan scores, credits used, and other data.

Original NVD description (English source)

The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ai_scan_result_remove' function in all versions up to, and including, 1.0.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all data in the wp_originalityai_log database table, which can include post titles, scan scores, credits used, and other data.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS