Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Missing Authorization vulnerability in AIpost AI WP Writer.This issue affects AI WP Writer: from n/a through 3.6.5.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
@wordfence @patchstackapp @wptavern @BleepinComputer 6/ Receipts: submitted privately via @wordfence's disclosure channel — auto-rejected in ~3 min, no reason. Appealed with package-diff proof it's not CVE-2024-30459 redux. Rejected again: "out of scope," no CVE, no bounty. So it's public now.
@wordfence @patchstackapp @wptavern @BleepinComputer 4/ Verified not a dupe: diffed the 3.6.5 / 3.6.5.6 packages — the assistcron action doesn't exist there; it was added after the CVE-2024-30459 fix. Also distinct from CVE-2025-22297 (CSRF). Affects the latest 4.6.3.2. CVSS 5.3 (Medium).