CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionNVD
The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ai_scan_result_remove' function in all versions up to, and including, 1.0.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all data in the wp_originalityai_log database table, which can include post titles, scan scores, credits used, and other data.
AnalysisAI
Originality.ai AI Checker plugin for WordPress allows authenticated attackers with Subscriber-level access to delete all scan result data from the wp_originalityai_log database table due to missing capability checks on the ai_scan_result_remove function in versions up to 1.0.15. The vulnerability enables unauthorized data loss affecting post titles, scan scores, and credit usage records; exploitation requires only standard WordPress authentication and no user interaction.
Technical ContextAI
The vulnerability exists in the Originality.ai WordPress plugin's handling of the 'ai_scan_result_remove' AJAX action. The affected function at OriginalityAI.php line 532 lacks proper WordPress capability verification (wp_verify_nonce and current_user_can checks) before processing deletion requests. This is a missing access control issue classified under CWE-285 (Improper Authorization). The plugin stores AI scan metadata in the wp_originalityai_log database table; the unprotected function permits any authenticated user-including those with minimal Subscriber role-to issue DELETE queries against this table. The vulnerability is compounded by the absence of role-based checks, which are standard WordPress practice for sensitive operations.
Affected ProductsAI
Originality.ai AI Checker plugin for WordPress in all versions up to and including 1.0.15. The vulnerability affects any WordPress installation with the plugin active; no specific CPE designation is provided in the references, but the WordPress plugin repository (plugins.trac.wordpress.org/browser/originality-ai) is the authoritative source. Affected administrators should check installed plugin versions against the 1.0.15 threshold.
RemediationAI
Update Originality.ai AI Checker to version 1.0.16 or later, which includes proper WordPress capability verification and nonce validation for the ai_scan_result_remove function (see WordPress plugin repository changeset 3371428). Administrators unable to immediately patch should restrict Subscriber-level user accounts or disable the plugin entirely. Implement principle-of-least-privilege access controls and audit existing database logs for any suspicious DELETE operations against wp_originalityai_log between the plugin installation date and patch deployment. Verify via Wordfence threat intelligence (https://www.wordfence.com/threat-intel/vulnerabilities/id/80dd4f6a-20dd-4532-913b-ab08f89db836) for additional context and advisories.
Share
External POC / Exploit Code
Leaving vuln.today