CVE-2025-12844 is a PHP Object Injection vulnerability in the AI Engine WordPress plugin (versions up to 3.1.8) via PHAR deserialization in the 'rest_simpleTranscribeAudio' and 'rest_simpleVisionQuery' functions. It allows authenticated attackers with low privileges (Subscriber and above) to inject PHP objects. Exploitation depends on the presence of a POP chain in other installed plugins or themes, which could enable arbitrary file deletion, data disclosure, or code execution. The vulnerability is rated high severity with a CVSS 3.1 score of 7.1. No patch or official remediation details are currently available.

If a POP chain is present in the WordPress environment, an attacker with Subscriber-level access could leverage this vulnerability to perform critical actions such as arbitrary file deletion, sensitive data retrieval, or remote code execution. Without a POP chain, the vulnerability cannot be exploited to cause impact. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, review installed plugins and themes for known POP chains and consider restricting Subscriber-level access or disabling the vulnerable REST API endpoints if possible. Monitor vendor channels for updates and apply official patches once released.