AI Threat Alert
CVE-2025-69134: OpenAI Chatbot WP Helper: unauth content deletion
HIGHThis CVE affects the 'OpenAI Chatbot for WordPress – Helper' plugin, where a missing authorization check (CWE-862) lets any unauthenticated visitor delete arbitrary WordPress content — posts, pages, or chatbot-related data — via a simple network request, no login or user interaction required (CVSS 7.5, AV:N/AC:L/PR:N/UI:N). The blast radius is meaningful given 4,228 downstream dependents and 6 other known CVEs in this same package, signaling a pattern of weak access controls rather than a one-off bug. There is no evidence of active exploitation (not in CISA KEV), no public exploit code, and no Nuclei scanning template, and EPSS data is unavailable, so near-term mass exploitation is unconfirmed but the trivial exploit path keeps opportunistic risk real. This is fundamentally a WordPress authorization flaw, not an LLM attack, but it rides on an AI-branded, customer-facing plugin, so it should be triaged alongside other CMS plugin exposure. Since no patched version is specified in the advisory, treat this as unpatched: disable or remove the plugin if not business-critical, restrict admin-ajax/REST endpoints via WAF rules, and monitor WordPress content/audit logs for unexplained deletions.
What is the risk?
Network-exploitable, unauthenticated, low-complexity attack (CVSS 7.5, availability-only impact) against a WordPress plugin that layers an OpenAI-powered chatbot on top of a site. No active exploitation signal (not in CISA KEV, no public PoC, no Nuclei template, EPSS unavailable), which lowers near-term urgency, but the trivial exploitation bar (no auth, no user interaction) and a track record of 6 other CVEs in this package elevate baseline risk. Confidentiality and integrity are unaffected per the CVSS vector — the exposure is destructive availability impact (content deletion), not data theft or manipulation.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| OpenAI Node | npm | — | No patch |
Do you use OpenAI Node? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step-
No patched version is listed in the available advisory data — verify with the vendor/WordPress.org plugin page for a fixed release above 1.1.4 and update immediately if one exists. Until patched, disable or uninstall the plugin, or restrict access to its AJAX/REST endpoints via a WAF rule blocking unauthenticated POST/DELETE-style requests. Enable WordPress audit logging (e.g., via a security plugin) to detect unexpected content/page deletions, and take regular backups so deleted content can be restored quickly. Review other plugins from the same vendor given 6 prior CVEs in this package, which suggests broader authorization hygiene issues.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2025-69134?
This CVE affects the 'OpenAI Chatbot for WordPress – Helper' plugin, where a missing authorization check (CWE-862) lets any unauthenticated visitor delete arbitrary WordPress content — posts, pages, or chatbot-related data — via a simple network request, no login or user interaction required (CVSS 7.5, AV:N/AC:L/PR:N/UI:N). The blast radius is meaningful given 4,228 downstream dependents and 6 other known CVEs in this same package, signaling a pattern of weak access controls rather than a one-off bug. There is no evidence of active exploitation (not in CISA KEV), no public exploit code, and no Nuclei scanning template, and EPSS data is unavailable, so near-term mass exploitation is unconfirmed but the trivial exploit path keeps opportunistic risk real. This is fundamentally a WordPress authorization flaw, not an LLM attack, but it rides on an AI-branded, customer-facing plugin, so it should be triaged alongside other CMS plugin exposure. Since no patched version is specified in the advisory, treat this as unpatched: disable or remove the plugin if not business-critical, restrict admin-ajax/REST endpoints via WAF rules, and monitor WordPress content/audit logs for unexplained deletions.
Is CVE-2025-69134 actively exploited?
No confirmed active exploitation of CVE-2025-69134 has been reported, but organizations should still patch proactively.
How to fix CVE-2025-69134?
No patched version is listed in the available advisory data — verify with the vendor/WordPress.org plugin page for a fixed release above 1.1.4 and update immediately if one exists. Until patched, disable or uninstall the plugin, or restrict access to its AJAX/REST endpoints via a WAF rule blocking unauthenticated POST/DELETE-style requests. Enable WordPress audit logging (e.g., via a security plugin) to detect unexpected content/page deletions, and take regular backups so deleted content can be restored quickly. Review other plugins from the same vendor given 6 prior CVEs in this package, which suggests broader authorization hygiene issues.
What systems are affected by CVE-2025-69134?
This vulnerability affects the following AI/ML architecture patterns: CMS-integrated AI chatbot plugins, customer-facing chat widgets.
What is the CVSS score for CVE-2025-69134?
CVE-2025-69134 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.29%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0049 Exploit Public-Facing Application Compliance Controls Affected
What are the technical details?
Original Advisory
Unauthenticated Arbitrary Content Deletion in OpenAI Chatbot for WordPress – Helper <= 1.1.4 versions.
Exploitation Scenario
An adversary scans for WordPress sites running the 'OpenAI Chatbot for WordPress – Helper' plugin and identifies the vulnerable endpoint that lacks a proper capability/nonce check. Without authenticating, they send a crafted HTTP request that triggers the plugin's content-deletion logic, wiping arbitrary posts, pages, or chatbot-related records. This could be used for site sabotage, extortion (threatening repeated deletions), or as a distraction/DoS while other reconnaissance occurs, and repeated abuse could erase records relevant to compliance evidence tied to the chatbot's operation.
Weaknesses (CWE)
CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
- [Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
- [Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References
Timeline
Related Vulnerabilities
GHSA-vjc7-jrh9-9j86 10.0 9Router: no-auth API leaks keys, chats, provider control
Same package: openai CVE-2025-61260 9.8 OpenAI Codex CLI: RCE via malicious MCP config files
Same package: openai CVE-2024-23827 9.8 Nginx-UI: arbitrary file write via cert import leads to RCE
Same package: openai GHSA-gqqj-85qm-8qhf 8.7 paperclipai: connector trust bypass enables Gmail read/write
Same package: openai CVE-2026-67425 8.6 Flyto2 Core: SSRF leaks LLM API keys via base_url
Same package: openai