CVE-2025-10902 is an improper authorization vulnerability (CWE-285) in the Originality.ai AI Checker WordPress plugin. The vulnerability arises because the 'ai_scan_result_remove' function lacks proper capability checks, enabling any authenticated user with at least Subscriber privileges to delete all data stored in the wp_originalityai_log table. This data includes post titles, scan results, and usage credits. The issue affects all versions up to and including 1.0.15. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and requiring low privileges but no user interaction. There is no indication of known exploits in the wild or available patches at this time.

An attacker with Subscriber-level access or higher can delete all data in the wp_originalityai_log database table, resulting in loss of post titles, scan scores, credits used, and other related data. This impacts data integrity and availability within the plugin's logging functionality but does not directly affect confidentiality or system availability beyond the plugin's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only and monitor for suspicious activity related to data deletion within the plugin. Avoid granting unnecessary privileges to low-level authenticated users.