CVE-2025-10902 Overview
CVE-2025-10902 is a missing authorization vulnerability in the Originality.ai AI Checker plugin for WordPress. The flaw affects all versions up to and including 1.0.15. The ai_scan_result_remove function does not perform a capability check before executing. Authenticated users with Subscriber-level access or higher can invoke the function to delete all records in the wp_originalityai_log database table. Deleted data can include post titles, scan scores, credits used, and related logging fields. The issue is tracked under [CWE-285] Improper Authorization.
Critical Impact
Any authenticated WordPress user, including low-privilege Subscribers, can wipe the plugin's scan log table, destroying historical AI-detection records.
Affected Products
- Originality.ai AI Checker plugin for WordPress
- All versions through 1.0.15
- WordPress sites exposing user registration or Subscriber accounts
Discovery Timeline
- 2025-10-24 - CVE-2025-10902 published to NVD
- 2026-10-08 - Last updated in NVD database
Technical Details for CVE-2025-10902
Vulnerability Analysis
The Originality.ai AI Checker plugin registers an AJAX handler that calls the ai_scan_result_remove function. The handler is reachable by any authenticated session but lacks a current_user_can() capability check and does not validate the caller's role. As a result, the function processes deletion requests from accounts that should have no administrative rights over plugin data.
When invoked, the function issues a database operation that removes rows from the wp_originalityai_log table. The table stores operational records such as post titles associated with scans, scan scores, credits consumed, and related metadata. Loss of this data breaks audit trails, reporting, and billing reconciliation that depend on plugin history.
The weakness is categorized as [CWE-285] Improper Authorization. The attack requires authentication but no user interaction and is network-reachable, which lowers the barrier on sites that permit open registration or already host low-privilege accounts.
Root Cause
The plugin exposes a destructive data operation through an AJAX endpoint without enforcing authorization. The handler trusts that any authenticated request is legitimate and omits a role or capability check prior to invoking the deletion query.
Attack Vector
An attacker authenticates to the target WordPress site with Subscriber-level credentials or higher. The attacker sends an AJAX request to the vulnerable endpoint registered by the plugin. The server executes ai_scan_result_remove, which deletes the contents of wp_originalityai_log. Technical details and the vulnerable source line are documented in the WordPress Plugin Source File and the Wordfence Vulnerability Report.
No public proof-of-concept exploit is referenced in the advisory, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-10902
Indicators of Compromise
- Unexpected empty state of the wp_originalityai_log table or sudden drop in row count.
- WordPress access logs showing AJAX POST requests to the plugin's admin-ajax endpoint from Subscriber accounts.
- Loss of historical AI scan records that previously existed in plugin reports.
Detection Strategies
- Monitor WordPress AJAX request patterns for the ai_scan_result_remove action invoked by non-administrative sessions.
- Enable database query auditing on DELETE statements targeting wp_originalityai_log.
- Compare installed plugin versions against the fixed release referenced in WordPress Changeset #3371428.
Monitoring Recommendations
- Alert on bulk row deletions in plugin-managed tables outside of administrator sessions.
- Track new Subscriber registrations followed by immediate AJAX activity against plugin endpoints.
- Review web server logs for repeated requests to wp-admin/admin-ajax.php with the plugin's action parameter.
How to Mitigate CVE-2025-10902
Immediate Actions Required
- Update the Originality.ai AI Checker plugin to the version released in WordPress Changeset #3371428, which is any release after 1.0.15.
- Audit WordPress user accounts and remove unused Subscriber-level accounts.
- Back up the wp_originalityai_log table before and after remediation to preserve historical records.
Patch Information
The vendor addressed the issue in the commit tracked as WordPress Changeset #3371428. The fix adds a capability check to the ai_scan_result_remove handler so that only authorized roles can trigger deletion. Site operators should upgrade through the WordPress plugin updater or by replacing the plugin directory with the patched release.
Workarounds
- Disable or uninstall the plugin until the patched version is deployed.
- Restrict new user registration or set the default role to one with no AJAX access to the vulnerable handler.
- Place the WordPress admin-ajax endpoint behind a web application firewall rule that blocks the ai_scan_result_remove action for non-administrative sessions.
# Configuration example
# Disable open registration in wp-config.php or via Settings > General
# Then force a plugin update via WP-CLI:
wp plugin update originality-ai
wp plugin list --name=originality-ai --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.