CVE-2025-12844

The AI Engine WordPress plugin has a security flaw in its handling of untrusted input in certain functions. Specifically, versions up to 3.1.8 are susceptible to PHP Object Injection via PHAR Deserialization in the 'rest_simpleTranscribeAudio' and 'rest_simpleVisionQuery' functions. If another vulnerable plugin or theme is present on the site, an attacker could potentially exploit this flaw to execute malicious actions such as deleting files or accessing sensitive data.

Based on public CVE data (MITRE/NVD).