The Originality.ai AI Checker plugin for WordPress contains a missing authorization check in its 'ai_scan_result_remove' function. Because the plugin fails to verify user capabilities, any authenticated user with Subscriber-level access or higher can call this function and delete all entries in the wp_originalityai_log table. This table holds post titles, scan scores, credit usage, and related metadata, so deletions result in irreversible loss of valuable audit and content data. The vulnerability is a classic privilege‑escalation/authorization flaw (CWE‑285) that affects confidentiality of audit information and the integrity of system logs.

All installations of the Originality.ai AI Checker plugin through version 1.0.15 are affected. The plugin is distributed under the originalityai:Originality.ai AI Checker CNA and is a WordPress plugin that adds AI‑based content originality checking. Users should verify which version they are running and consider upgrading to version 1.0.16 or newer.

Although the CVSS score is 4.3, the vulnerability can be exploited by any logged‑in user with Subscriber roles, a common level of access in many sites. The EPSS score is less than 1 %, indicating a low publicly observed exploitation probability, and the issue is not listed in CISA’s KEV catalog. Nonetheless, because delete operations cannot be recovered except via backups, the impact on the affected systems is significant. The attack vector is straightforward: a user who can authenticate to the WordPress admin area can invoke the deletion endpoint directly, assuming no additional protective filters are in place.