CVE-2025-12844: AI Engine WordPress Object Injection Flaw

CVE-2025-12844 Overview

CVE-2025-12844 is a PHP Object Injection vulnerability in the AI Engine plugin for WordPress, affecting all versions up to and including 3.1.8. The flaw resides in the rest_simpleTranscribeAudio and rest_simpleVisionQuery REST endpoints, which deserialize untrusted input via PHAR (PHP Archive) handling. Authenticated attackers with Subscriber-level access or higher can inject arbitrary PHP objects. The vulnerability is classified under [CWE-502] Deserialization of Untrusted Data.

Critical Impact
When a Property-Oriented Programming (POP) chain exists in another installed plugin or theme, attackers can delete arbitrary files, exfiltrate sensitive data, or achieve remote code execution.

Affected Products

AI Engine plugin for WordPress, all versions up to and including 3.1.8
WordPress installations with the AI Engine plugin enabled
Sites where additional plugins or themes provide a usable POP chain

Discovery Timeline

2025-11-13 - CVE-2025-12844 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-12844

Vulnerability Analysis

The AI Engine plugin exposes two REST API endpoints, rest_simpleTranscribeAudio and rest_simpleVisionQuery, that accept user-supplied file paths. These functions pass attacker-controlled input into PHP file operations that trigger PHAR stream wrapper handling. When PHP processes a phar:// URL through functions such as file_exists, filesize, or fopen, it automatically deserializes the metadata stored within the PHAR archive.

Deserialization invokes PHP magic methods such as __wakeup and __destruct on the resulting objects. Without a gadget chain in the plugin itself, the deserialized objects cannot directly execute attacker logic. However, WordPress sites typically run dozens of plugins and themes, many of which contain classes whose magic methods perform file operations, database queries, or other sensitive actions.

Root Cause

The root cause is unsafe handling of user-controlled paths passed to PHP file functions that honor the phar:// stream wrapper. The vulnerable code paths are referenced in classes/api.php, classes/engines/chatml.php, classes/modules/files.php, and classes/services/image.php. Input validation does not restrict the URL scheme, allowing phar:// references to attacker-uploaded files.

Attack Vector

Exploitation requires an authenticated account at Subscriber level or higher. The attacker first uploads a crafted PHAR file disguised as a benign media asset, such as an image or audio file. Next, the attacker invokes one of the vulnerable REST endpoints, supplying a phar:// path pointing to the uploaded file. PHP deserializes the embedded object metadata, triggering any POP chain present in the WordPress instance.

See the Wordfence Vulnerability Analysis and the WordPress Changeset for code-level details.

Detection Methods for CVE-2025-12844

Indicators of Compromise

Requests to REST routes invoking rest_simpleTranscribeAudio or rest_simpleVisionQuery from low-privilege user sessions
File upload activity producing files with .phar, .jpg, or .mp3 extensions containing PHAR magic bytes (__HALT_COMPILER)
Request parameters containing the phar:// URL scheme directed at the WordPress uploads directory
Unexpected file deletions, database changes, or outbound connections following AI Engine endpoint activity

Detection Strategies

Inspect HTTP request bodies and query strings for the phar:// substring targeting AI Engine REST routes
Scan the wp-content/uploads directory for files containing the __HALT_COMPILER(); token
Correlate Subscriber-level authentication events with subsequent calls to AI Engine REST endpoints
Monitor PHP error logs for unserialization warnings and unexpected magic method invocations

Monitoring Recommendations

Enable WordPress audit logging for REST API access and user role activity
Alert on creation of executable archives within media upload directories
Track plugin and theme inventories so POP chain exposure can be assessed when new components are installed
Forward web server, PHP, and WordPress logs to a centralized analytics platform for cross-source correlation

How to Mitigate CVE-2025-12844

Immediate Actions Required

Update the AI Engine plugin to a version newer than 3.1.8 that contains the fix from changeset 3392052
Audit all Subscriber and higher accounts and remove unused or suspicious users
Review installed plugins and themes for known POP gadget chains and remove unnecessary components
Inspect the uploads directory for PHAR payloads and remove any unauthorized files

Patch Information

The vendor addressed the vulnerability in the WordPress Changeset 3392052. Site administrators should apply the latest AI Engine release through the WordPress plugin manager. Verify the installed version matches or exceeds the patched release after update.

Workarounds

Restrict registration so untrusted users cannot obtain Subscriber accounts
Deploy a web application firewall rule blocking phar:// strings in requests to /wp-json/ endpoints
Disable the AI Engine plugin until patching is complete if updates cannot be applied immediately
Configure PHP to disallow PHAR stream wrapper usage where the application does not require it

bash

# Example: disable the phar stream wrapper in php.ini
disable_functions = phar_stream_wrapper
# Or restrict allowed URL schemes for file functions
allow_url_fopen = Off
allow_url_include = Off