Missing Authorization vulnerability in WP Grids WP Wand ai-content-generation

CVE-2025-22302 is a missing authorization flaw in the WordPress plugin WP Wand (ai-content-generation) affecting versions through 1.2.5 and fixed in 1.2.6. Public advisories describe missing capability checks on several plugin functions, meaning an unauthenticated remote attacker can hit plugin functionality they should not be allowed to use. In practical terms, that usually means abusing AI-content actions, generating or altering content-related workflow, or driving unwanted API consumption on sites that expose the plugin.

The vendor's 5.3/MEDIUM rating is defensible in a vacuum because the bug is network-reachable and requires no auth, but it still overstates enterprise urgency. The real-world brakes are strong: the plugin only shows 1,000+ active installs, the impact is scored integrity-low only with no confidentiality or availability impact, and there is no KEV listing, no public exploitation signal, and a very low EPSS. For a team managing 10,000 hosts, this is not where you spend your scarce emergency patching energy.

Why this verdict

• Downward: narrow reachable population — WordPress.org reports only 1,000+ active installs, so this is not a mass-exposure enterprise mainline like a core CMS or edge appliance flaw.
• Downward: post-exploitation value is limited — the CVSS impact is integrity-low only, with no indication of credential theft, data exfiltration, RCE, or durable host compromise.
• Downward: no exploit heat — no KEV, no public exploitation evidence, and EPSS 0.00135 all argue against emergency treatment.
• Upward: unauthenticated remote path — the attack does not require login, user interaction, or prior foothold, so it cannot be ignored outright.

Why not higher?

If this flaw enabled admin creation, arbitrary file write, secrets exposure, or code execution, the unauthenticated remote nature would push it sharply upward. But the available evidence points to plugin-function abuse with low integrity impact, and that is materially less dangerous than a true takeover bug.

Why not lower?

This is still a real unauthenticated internet-facing authorization failure, not a theoretical code smell. On a public WordPress site using the vulnerable plugin, an attacker can automate abuse cheaply, so it deserves patching in routine maintenance rather than a documentation-only dismissal.

1. Update or remove the plugin — Move affected sites to WP Wand 1.2.6 or later, or remove the plugin if it is not business-critical. For a LOW verdict there is no SLA — treat as backlog hygiene, but do not leave dead plugins installed indefinitely.
2. Restrict public access to WordPress action endpoints — Use WAF or web-server rules to reduce unauthenticated access to wp-admin/admin-ajax.php and any plugin-specific endpoints where practical, especially on sites that do not need anonymous interactive features. For LOW, there is no mitigation SLA; apply as part of routine hardening.
3. Watch for content and billing anomalies — Add checks for unexpected post creation, unexplained content edits, and spikes in outbound AI-provider usage or API billing. This catches the most likely business impact while you schedule remediation in normal maintenance.
4. Inventory WordPress plugins centrally — Use WP-CLI, agent-based file inventory, or your CMDB to enumerate ai-content-generation versions across estates. This is the fastest way to turn a fuzzy internet bug into a precise host-level remediation list.

Run this on the target WordPress host or on a mounted backup of the site filesystem. Invoke it as sudo bash check_cve_2025_22302_wpwand.sh /var/www/html and give it read access to the WordPress directory; root is only needed if your web content is otherwise unreadable.

#!/usr/bin/env bash
# check_cve_2025_22302_wpwand.sh
# Detects whether WP Wand (ai-content-generation) is vulnerable to CVE-2025-22302.
# Usage: bash check_cve_2025_22302_wpwand.sh /path/to/wordpress
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

TARGET="${1:-}"
PLUGIN_DIR=""
VERSION=""

if [[ -z "$TARGET" ]]; then
  echo "UNKNOWN - usage: $0 /path/to/wordpress"
  exit 2
fi

if [[ ! -d "$TARGET" ]]; then
  echo "UNKNOWN - target path does not exist: $TARGET"
  exit 2
fi

PLUGIN_DIR="$TARGET/wp-content/plugins/ai-content-generation"
if [[ ! -d "$PLUGIN_DIR" ]]; then
  echo "UNKNOWN - plugin directory not found: $PLUGIN_DIR"
  exit 2
fi

version_le() {
  # returns 0 if $1 <= $2
  local a="$1" b="$2"
  [[ "$a" == "$b" ]] && return 0
  local first
  first=$(printf '%s\n%s\n' "$a" "$b" | sort -V | head -n1)
  [[ "$first" == "$a" ]]
}

# 1) Try readme.txt stable tag / version markers
if [[ -f "$PLUGIN_DIR/readme.txt" ]]; then
  VERSION=$(grep -Eim1 '^(Stable tag|Version):' "$PLUGIN_DIR/readme.txt" | sed -E 's/^[^:]+:[[:space:]]*//I' | tr -d '\r')
fi

# 2) Try plugin PHP headers if readme parsing failed
if [[ -z "$VERSION" ]]; then
  while IFS= read -r -d '' phpfile; do
    candidate=$(grep -Eim1 '^\s*Version:\s*' "$phpfile" | sed -E 's/^\s*Version:\s*//I' | tr -d '\r')
    if [[ -n "$candidate" ]]; then
      VERSION="$candidate"
      break
    fi
  done < <(find "$PLUGIN_DIR" -maxdepth 2 -type f -name '*.php' -print0 2>/dev/null)
fi

# 3) Sanitize version string
VERSION=$(echo "$VERSION" | grep -Eo '[0-9]+(\.[0-9]+){1,3}' | head -n1 || true)

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN - could not determine installed WP Wand version"
  exit 2
fi

if version_le "$VERSION" "1.2.5"; then
  echo "VULNERABLE - WP Wand version $VERSION is <= 1.2.5"
  exit 1
fi

if version_le "1.2.6" "$VERSION" || [[ "$VERSION" == "1.2.6" ]]; then
  echo "PATCHED - WP Wand version $VERSION is >= 1.2.6"
  exit 0
fi

# Fallback; should be unreachable for normal semantic versions
echo "UNKNOWN - parsed version $VERSION but comparison was inconclusive"
exit 2

Sources

1. OpenCVE record for CVE-2025-22302
2. WordPress.org plugin page for WP Wand
3. WordPress.org advanced view for WP Wand
4. Wordfence vulnerability entry for CVE-2025-22302
5. Wordfence weekly report including CVE-2025-22302
6. WPScan vulnerability entry
7. Patchstack advisory
8. CISA Known Exploited Vulnerabilities Catalog