Site icon Cybercory

CVE‑2025‑7847: Arbitrary File Upload in AI Engine Puts 100K+ WordPress Sites at Risk of RCE

Ouaissou DEMBELE

On 18 July 2025, researchers at Wordfence disclosed CVE‑2025‑7847, a high-severity (CVSS 8.8) arbitrary file upload vulnerability in the widely used AI Engine WordPress plugin, affecting versions 2.9.3 and 2.9.4-active on over 100,000 installations. Authenticated users with as little as subscriber-level access could exploit the exposed REST API to upload malicious files, potentially triggering remote code execution. This poses an urgent threat to site integrity globally.

What’s Happened & Timeline of Discovery

DateMilestone
18 July 2025Wordfence received report and validated PoC within hours.
21 July 2025Wordfence Premium, Care & Response users received virtual firewall rules.
22 July 2025Plugin developer released AI Engine version 2.9.5 patching the issue.
20 August 2025Free Wordfence users slated to receive the protections.

Technical Roots of the Vulnerability

The flaw lies in the function rest_simpleFileUpload()-used when Public API is enabled-which lacks file type validation, allowing authenticated attackers to upload arbitrary files, including .php shells, via the REST endpoint. Uploads are saved to the publicly accessible wp-content/uploads/. Wordfence rated the flaw CVSS 8.8, underscoring serious risk.

Impact & Risk Velocity

Expert Perspectives

“This makes it possible for authenticated attackers, with Subscriber-level access… to upload arbitrary files… which may make remote code execution possible.”
— Wordfence advisory, 18 July 2025

“The AI Engine plugin flaw lets even low-level user accounts escalate to full admin control if misconfigured.”
— Security summarization by SecurityOnline.info

Patch & Mitigation Measures

4. 10 Practical Security Recommendations

  1. Update now: Ensure all WordPress sites using AI Engine are running v2.9.5 or later.
  2. Disable Public API if unused to eliminate the vulnerable endpoint.
  3. Restrict subscriber-level uploads: only grant REST API file upload capabilities to trusted roles.
  4. Enable WAF rules: apply Wordfence or other web application firewall protections immediately.
  5. Audit upload directories for recent .php files that could indicate compromise.
  6. Review user roles and permissions, minimizing subscriber-level access where possible.
  7. Monitor logs (access, error, REST API activity) for unusual file upload activity.
  8. Segregate admin modules such as Dev Tools and MCP on production sites.
  9. Educate content teams about risks of enabling advanced plugin features.
  10. Subscribe to WordPress security [news, updates, alerts, best practices, trends] to stay proactive: see cybercory.com and for hands-on services check saintynet.com.

5. Conclusion

CVE‑2025‑7847 in AI Engine is a sharp reminder: even authenticated file uploads can lead to full WordPress site takeover if input validation is neglected. With over 100,000 websites affected, swift patching, configuration review, and layered defenses are essential. Administrators must act immediately to mitigate risk and avoid compromise. Vigilance and defense‑in‑depth remain the cornerstone of WordPress security.

Sources

Exit mobile version