High · published November 13, 2025
⚡Authenticated users with Subscriber-level access can turn into puppet masters with a simple injection! The AI Engine plugin for WordPress is vulnerable to PHP Object Injection via PHAR Deserialization in all versions up to 3.1.8. 🔥 Think of it like a restaurant where a well-meaning but misinformed customer tries to customize their order without the chef verifying the changes — if the kitchen is already chaotic, things could go horribly wrong! An attacker could exploit this vulnerability to inject a PHP Object, potentially leading to the ability to delete files, steal sensitive data, or even execute arbitrary code if a malicious plugin or theme (the hidden chaos in the kitchen) is present. It may start as a harmless add-on, but with this vulnerability, your site could be at risk of significant damage!
Think of it like a restaurant where a well-meaning but misinformed customer tries to customize their order without the chef verifying the changes — if the kitchen is already chaotic, things could go horribly wrong! The vulnerability arises from the deserialization of untrusted input in the 'rest_simpleTranscribeAudio' and 'rest_simpleVisionQuery' functions, which allows for PHP Object Injection if another plugin or theme contains a suitable payload (POP chain).
An attacker could exploit this vulnerability to inject a PHP Object, potentially leading to the ability to delete files, steal sensitive data, or even execute arbitrary code if a malicious plugin or theme (the hidden chaos in the kitchen) is present. It may start as a harmless add-on, but with this vulnerability, your site could be at risk of significant damage! To protect your site, upgrade the AI Engine plugin to version 3.1.9 or higher immediately. Conduct a security audit to ensure no malicious plugins or themes are installed that could exploit this vulnerability. Regularly monitor your site for any unusual activities! You've got this! Stay proactive and secure your site like the superhero you are! 🛡️