CVE-2025-10901

MediumCVSS 4.3/10Last modified Oct 8, 2026

Description

The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ai_get_table' function in all versions up to, and including, 1.0.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read all data in the wp_originalityai_log database table, which can include post titles, scan scores, credits used, and other data.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Oct 24, 2025
Last modified: Oct 8, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-109024.3The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ai_s CVE-2025-109036.5GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that CVE-2025-109054.4Collision in MiniFilter driver in Avast Software Avast Free Antivirus before 25.9 on Windows allows a local attacker with administrative p CVE-2025-109068.4A flaw has been found in Magnetism Studios Endurance up to 3.3.0 on macOS. This affects the function loadModuleNamed:WithReply of the file /CVE-2025-109077.2An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination i CVE-2025-109087.3Due to a lack of user account state validation during authentication, locked user accounts can be successfully authenticated using Magic Lin CVE-2025-109092.4A security flaw has been discovered in Mangati NovoSGA up to 2.2.9. The impacted element is an unknown function of the file /admin of the co CVE-2025-10914.3A Broken Authorization schema exists where any authenticated user could download IOA script and configuration files if the URL is known.CVE-2025-109109.3A flaw in the binding process of Govee’s cloud platform and devices allows a remote attacker to bind an existing, online Govee device to the CVE-2025-109115.5A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and applica CVE-2025-109125.4Authorization Bypass Through User-Controlled Key vulnerability in Saastech Cleaning and Internet Services Inc. TemizlikYolda allows Manipula CVE-2025-109138.3Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saastech Cleaning and Internet