Critical · published November 26, 2025
🚨 An unauthenticated user can upload any file they want through the AI Feeds plugin for WordPress, like letting a stranger into your house with the code to your alarm! Imagine if a hotel allowed guests to change their room locks without checking their ID — suddenly, anyone could waltz in and take whatever they wanted! That’s the kind of security slip-up we’re facing here with this plugin. This vulnerability is absolutely devastating! An attacker could download any GitHub repository and potentially alter critical plugin files, leading to remote code execution. Your website could be compromised, and sensitive data could be at risk!
Imagine if a hotel allowed guests to change their room locks without checking their ID — suddenly, anyone could waltz in and take whatever they wanted! That’s the kind of security slip-up we’re facing here with this plugin. The AI Feeds plugin lacks a necessary capability check in the 'actualizador_git.php' file, allowing unauthenticated attackers to upload and execute arbitrary files on the server.
This vulnerability is absolutely devastating! An attacker could download any GitHub repository and potentially alter critical plugin files, leading to remote code execution. Your website could be compromised, and sensitive data could be at risk! To safeguard your site, immediately update the AI Feeds plugin to version 1.0.12 or later. Additionally, review your user permissions and restrict file upload capabilities where possible. Regularly audit and monitor your site for any unauthorized changes. You've got this! With these steps, you’ll shore up your defenses in no time. 🛡️