What is the CVSS score of CVE-2025-10902?

CVE-2025-10902 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-10902

MEDIUM

Improper Authorization (CWE-285)

2025-10-24 security@wordfence.com

Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 18:38 vuln.today

CVE Published

Oct 24, 2025 - 09:15 nvd

MEDIUM 4.3

DescriptionCVE.org

The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ai_scan_result_remove' function in all versions up to, and including, 1.0.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all data in the wp_originalityai_log database table, which can include post titles, scan scores, credits used, and other data.

AnalysisAI

Originality.ai AI Checker plugin for WordPress allows authenticated attackers with Subscriber-level access to delete all scan result data from the wp_originalityai_log database table due to missing capability checks on the ai_scan_result_remove function in versions up to 1.0.15. The vulnerability enables unauthorized data loss affecting post titles, scan scores, and credit usage records; exploitation requires only standard WordPress authentication and no user interaction.

Technical ContextAI

The vulnerability exists in the Originality.ai WordPress plugin's handling of the 'ai_scan_result_remove' AJAX action. The affected function at OriginalityAI.php line 532 lacks proper WordPress capability verification (wp_verify_nonce and current_user_can checks) before processing deletion requests. This is a missing access control issue classified under CWE-285 (Improper Authorization). The plugin stores AI scan metadata in the wp_originalityai_log database table; the unprotected function permits any authenticated user-including those with minimal Subscriber role-to issue DELETE queries against this table. The vulnerability is compounded by the absence of role-based checks, which are standard WordPress practice for sensitive operations.

Affected ProductsAI

Originality.ai AI Checker plugin for WordPress in all versions up to and including 1.0.15. The vulnerability affects any WordPress installation with the plugin active; no specific CPE designation is provided in the references, but the WordPress plugin repository (plugins.trac.wordpress.org/browser/originality-ai) is the authoritative source. Affected administrators should check installed plugin versions against the 1.0.15 threshold.

RemediationAI

Update Originality.ai AI Checker to version 1.0.16 or later, which includes proper WordPress capability verification and nonce validation for the ai_scan_result_remove function (see WordPress plugin repository changeset 3371428). Administrators unable to immediately patch should restrict Subscriber-level user accounts or disable the plugin entirely. Implement principle-of-least-privilege access controls and audit existing database logs for any suspicious DELETE operations against wp_originalityai_log between the plugin installation date and patch deployment. Verify via Wordfence threat intelligence (https://www.wordfence.com/threat-intel/vulnerabilities/id/80dd4f6a-20dd-4532-913b-ab08f89db836) for additional context and advisories.