The AI Copilot – Content Generator plugin for WordPress contains missing capability checks and nonce verification on two AJAX actions, removeGroup and clear. Because the base controller’s getPermissions() returns an empty array and neither action is listed among the nonced methods, the authorization gate always grants access. An unauthenticated user can therefore send an AJAX request and delete individual records by ID or wipe all data from any module’s database table; the consequence is loss of content and potential site disruption.

This vulnerability affects the AI Copilot – Content Generator plugin published by wupsales. All releases up to and including version 1.4.12 are impacted. Versions newer than 1.4.12 have not been identified as containing the flaw.

The flaw has a CVSS score of 5.3, indicating moderate severity. The EPSS score is less than 1 %, suggesting that exploitation is unlikely in the wild, and the issue is not listed in the CISA KEV catalog. Based on the description, the attack vector is remote: any client that can reach the WordPress site’s AJAX endpoint can trigger the deletion. The lack of authentication grants the attacker the ability to delete data without authorization.