CVE-2025-7780

—

CVSS 3.1

6.5 medium

EPSS

<1%p42

Published

Jul 24, 2025 (Jul 24, 2025)

Modified

Jun 17, 2026

Description

The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4. The simpleTranscribeAudio endpoint fails to restrict URL schemes before calling get_audio(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to read any file on the web server and exfiltrate it via the plugin’s OpenAI API integration.

Ecosystems: WordPress
Weakness: CWE-200
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.