CVE-2025-12156
Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One 2.0.7 - 2.2.6 - Missing Authorization to Authenticated (Subscriber+) Post Creation
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
The Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_post_data() function in versions 2.0.7 to 2.2.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create and publish arbitrary posts.
| CWE | CWE-862 |
| Vendor | aitool |
| Product | ai auto tool content writing assistant (gemini writer, chatgpt ) all in one |
| Published | Nov 4, 2025 |
| Last Updated | Nov 4, 2025 |
Stay Ahead of the Next One
Get instant alerts for aitool ai auto tool content writing assistant (gemini writer, chatgpt ) all in one
Be the first to know when new medium vulnerabilities affecting aitool ai auto tool content writing assistant (gemini writer, chatgpt ) all in one are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
aitool / Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One
2.0.7 ≤ 2.2.6
References
Credits
Kenneth Dunn