Unauthorized Data Deletion in Originality.ai Plugin for WordPress

CVE-2025-10902

What is CVE-2025-10902?

The Originality.ai AI Checker plugin for WordPress has a significant vulnerability that allows authenticated users with Subscriber-level access and above to delete critical data from the wp_originalityai_log database table. This includes sensitive information such as post titles, scan scores, and credits used. The vulnerability is due to a lack of a necessary capability check in the 'ai_scan_result_remove' function, which could lead to unauthorized data manipulation and loss, highlighting the importance of implementing proper access controls in plugin development.

References