The "AI Power: Complete AI Pack" WordPress plugin has a PHP Object Injection flaw in versions up to 1.8.96. The vulnerability arises when the plugin deserializes data from the $form['post_content'] variable within the wpaicg_export_prompts function, allowing an attacker to inject a PHP object. While no point of presentation (POP) chain exists within the plugin itself, the presence of a POP chain elsewhere—such as in another plugin or active theme—could turn the injection into code execution, arbitrary file deletion, or sensitive data exfiltration.

WordPress sites running the senols AI Puffer (formerly AI Power) plugin at version 1.8.96 or earlier are impacted. The specific vendor is senols, and the plugin is known as AI Puffer. No additional version details beyond 1.8.96 are listed.

The CVSS base score of 7.2 indicates a medium‑high severity. The EPSS score of less than 1% suggests a very low likelihood of exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers must be authenticated as administrators to exploit the flaw, making the requirement of administrative privileges a significant mitigating factor. Nevertheless, if an attacker obtains admin rights and a POP chain is present via another component, the impact could expand to full code execution or data loss.