The vulnerability arises from unsafe deserialization of the $form['post_content'] variable in the wpaicg_export_ai_forms() function of the AI Power plugin for WordPress. Authenticated users with admin rights can inject PHP objects. Without a gadget chain in the plugin, direct exploitation is limited, but if other installed components provide a POP chain, severe impacts such as arbitrary file deletion, sensitive data retrieval, or remote code execution may occur. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated administrator to inject PHP objects via deserialization, potentially leading to arbitrary file deletion, sensitive data exposure, or remote code execution if a suitable POP chain exists in the environment. The vulnerability compromises confidentiality, integrity, and availability of the affected WordPress site.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict administrative access to trusted users only and consider disabling or removing the affected plugin if possible. Monitor vendor channels for updates and apply patches promptly once available.