The AI Power: Complete AI Pack WordPress plugin (renamed AI Puffer) suffers from a missing capability check in the wpaicg_save_image_media function in all versions up to 1.8.96. This authorization bypass allows authenticated users with low privileges (Subscriber or above) to upload images containing shortcode attributes in the image_alt field that execute upon POST requests to the attachment page. The vulnerability is classified as CWE-862 (Missing Authorization) and has a CVSS 3.1 base score of 6.3, indicating a medium severity impact with network attack vector, low attack complexity, and no user interaction required.

An attacker with Subscriber-level access or higher can exploit this vulnerability to upload images with embedded shortcode attributes that execute on the server side when processed. This can lead to limited confidentiality, integrity, and availability impacts, such as unauthorized code execution or manipulation of content. However, the impact is constrained by the requirement for authenticated access and the medium CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and monitor for suspicious activity related to image uploads. Avoid granting Subscriber-level or higher access to untrusted users. Follow vendor updates closely for patches or official mitigations.