CVE-2025-12156: Ai Auto Tool Content Writing Assistant plugin missing capability check

Summary

The Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT) All in One plugin for WordPress is vulnerable to unauthorized modification of data in versions 2.0.7 to 2.2.6. The save_post_data() function lacks a capability check (CWE-862, Missing Authorization). Authenticated attackers with Subscriber-level access and above can create and publish arbitrary posts.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
• InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online