The AI Power: Complete AI Pack plugin contains a PHP Object Injection flaw that arises when attacker‑controlled data from the $form['post_content'] field is deserialized in the wpaicg_export_ai_forms() function. The flaw requires the attacker to have administrative privileges on the WordPress site. While the plugin itself does not implement a PHP Object Power (POP) chain, the injected object can be leveraged by a POP chain introduced in another plugin or theme to delete arbitrary files, read sensitive data, or execute arbitrary code, thereby compromising confidentiality, integrity, or availability of the site.

WordPress sites running the AI Power: Complete AI Pack plugin version 1.8.96 or earlier, developed by senols under the brand AI Puffer – Your AI engine for WordPress, are impacted. The vulnerability is present in all affected releases regardless of the site's configuration, as long as an administrator can trigger the export function.

The CVSS score of 7.2 indicates a high severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely but should not be discounted, especially in environments where the attacker already has administrative credentials. The vulnerability is not listed in the CISA KEV catalog. An effective attack would require the presence of an additional POP chain; if none exists, the risk is lower. However, many WordPress installations host multiple plugins and themes, making a POP chain a realistic scenario. Administrators should therefore assume a potentially significant threat if the site is not already protected against such injection attacks.