CVE-2025-7847

HIGH

AI Engine 2.9.3-2.9.4 - Authenticated Arbitrary File Upload via rest_simpleFileUpload

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-7847. PoCs published by EricArdiansa.

AI-analyzed exploit summary This repository contains functional exploit code for CVE-2025-7847, an authenticated arbitrary file upload vulnerability in the WordPress AI Engine plugin (versions 2.9.3-2.9.4). The exploit automates login, nonce extraction, and file upload to achieve remote code execution via reverse shell or web shell upload.

Description

The AI Engine plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest_simpleFileUpload() function in versions 2.9.3 and 2.9.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server when the REST API is enabled, which may make remote code execution possible.

Exploits (1)

nomisec WORKING POC 1 stars
by EricArdiansa · poc
https://github.com/EricArdiansa/CVE-2025-7847-POC

This repository contains functional exploit code for CVE-2025-7847, an authenticated arbitrary file upload vulnerability in the WordPress AI Engine plugin (versions 2.9.3-2.9.4). The exploit automates login, nonce extraction, and file upload to achieve remote code execution via reverse shell or web shell upload.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: WordPress AI Engine Plugin 2.9.3-2.9.4
Auth required
Prerequisites: WordPress AI Engine plugin with Public API enabled · Valid WordPress credentials · No Bearer Token or custom authentication configured
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (5)

Core 5

Scores

CVSS v3 8.8
EPSS 0.0099
EPSS Percentile 57.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-434
Status published
Products (1)
tigroumeow/AI Engine 2.9.3 - 2.9.4
Published Jul 31, 2025
Tracked Since Feb 18, 2026