The vulnerability in AI Puffer (formerly AI Power) WordPress plugin arises from unsafe deserialization of untrusted input in the wpaicg_export_prompts function, specifically from the $form['post_content'] variable. This PHP Object Injection flaw allows authenticated administrators to inject malicious PHP objects. Although the plugin does not contain a gadget chain for exploitation, if other installed plugins or themes provide one, attackers could leverage this to perform destructive or unauthorized actions such as deleting files, accessing sensitive information, or executing arbitrary code.

Successful exploitation can lead to full compromise of the affected WordPress site, including confidentiality, integrity, and availability impacts. Specifically, attackers with admin privileges can inject PHP objects that, combined with gadget chains from other components, may result in arbitrary code execution, data theft, or file deletion. The CVSS score of 7.2 reflects the high impact and network attack vector with low attack complexity but requiring high privileges and no user interaction.

No official patch or fix is currently documented in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted users only and consider disabling or removing the vulnerable plugin. Review other installed plugins and themes for potential gadget chains that could be exploited in conjunction with this vulnerability.