{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-4592", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-05-12T15:26:48.824Z", "datePublished": "2025-06-14T08:23:25.234Z", "dateUpdated": "2026-04-08T16:56:56.341Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:56:56.341Z"}, "affected": [{"vendor": "aspengrovestudios", "product": "AI Image Lab \u2013 Free AI Image Generator", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The AI Image Lab \u2013 Free AI Image Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the 'wpz-ai-images' page. This makes it possible for unauthenticated attackers to update the plugin's API key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "AI Image Lab \u2013 Free AI Image Generator <= 1.0.6 - Cross-Site Request Forgery to API Key Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/61d56713-59af-4ad9-8744-6c6a5e5fe213?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ai-image-generator-lab/trunk/includes/admin/admin-page.php#L3"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Kishan Vyas"}], "timeline": [{"time": "2025-06-13T19:41:34.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-16T16:45:59.027058Z", "id": "CVE-2025-4592", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-17T18:39:10.244Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-4592", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-16T16:45:59.027058Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-16T16:47:13.501Z"}}], "cna": {"title": "AI Image Lab \u2013 Free AI Image Generator <= 1.0.6 - Cross-Site Request Forgery to API Key Update", "credits": [{"lang": "en", "type": "finder", "value": "Kishan Vyas"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "aspengrovestudios", "product": "AI Image Lab \u2013 Free AI Image Generator", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-06-13T19:41:34.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/61d56713-59af-4ad9-8744-6c6a5e5fe213?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ai-image-generator-lab/trunk/includes/admin/admin-page.php#L3"}], "descriptions": [{"lang": "en", "value": "The AI Image Lab \u2013 Free AI Image Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the 'wpz-ai-images' page. This makes it possible for unauthenticated attackers to update the plugin's API key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:56:56.341Z"}}}, "cveMetadata": {"cveId": "CVE-2025-4592", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:56:56.341Z", "dateReserved": "2025-05-12T15:26:48.824Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-06-14T08:23:25.234Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The AI Image Lab \u2013 Free AI Image Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the 'wpz-ai-images' page. This makes it possible for unauthenticated attackers to update the plugin's API key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento AI Image Lab \u2013 Free AI Image Generator para WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 1.0.6 incluida. Esto se debe a la falta o la validaci\u00f3n incorrecta de nonce en la p\u00e1gina 'wpz-ai-images'. Esto permite que atacantes no autenticados actualicen la clave API del complemento mediante una solicitud falsificada, ya que pueden enga\u00f1ar al administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-4592", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-06-14T09:15:23.333", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ai-image-generator-lab/trunk/includes/admin/admin-page.php#L3"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/61d56713-59af-4ad9-8744-6c6a5e5fe213?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T20:14:36.446672+00:00", "value": {"mitigation_remediation": ["Upgrade AI Image Lab \u2013 Free AI Image Generator to the latest version from the WordPress repository or vendor; the newer releases fix the nonce validation issue.", "If upgrading is not an option, remove or disable the wpz-ai-images page for non\u2011administrator users to prevent unauthorized API key changes.", "Implement a proper nonce check on the wpz-ai-images page, ensuring that all HTTP methods that modify the API key validate a cryptographic token unique to the current admin session."], "summary": {"action": "Apply Patch", "impact": "Privilege escalation via API key compromise"}, "threat_synthesis": {"affected_systems": "All versions of the Aspengrove Studios AI Image Lab \u2013 Free AI Image Generator plugin up to and including 1.0.6 are vulnerable. The issue is specific to the wpz-ai-images administrative page exposed within the WordPress admin interface.", "description_and_impact": "The AI Image Lab \u2013 Free AI Image Generator plugin for WordPress contains a cross\u2011site request forgery flaw on the wpz-ai-images settings page due to missing or incorrect nonce validation. An unauthenticated attacker can trick a site administrator into clicking a forged link, resulting in the plugin\u2019s API key being overwritten. This does not grant direct remote code execution but gives the attacker control over the key, potentially allowing the attacker to abuse the underlying image\u2011generation service for malicious purposes.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a medium severity vulnerability. The EPSS score of less than 1% suggests exploitation is unlikely, and the feature is not listed in CISA's KEV catalog. The attack requires social engineering to coerce a site administrator into executing a crafted request, making it a low\u2011probability event but one that can grant the attacker the ability to manipulate the API key used for image generation services."}}}}, "created": "2026-04-21T20:15:44.581566+00:00", "updated": "2026-04-21T20:15:44.581579+00:00", "vendors": []}