CVE-2025-0744

Summary

CVE-2025-0744 is a newly discovered access control vulnerability affecting EmbedAI versions 2.1 and below. Maliciously authenticated users can exploit this weakness by making a POST request to the "/demos/embedai/pmt_cash_on_delivery/pay" endpoint, enabling them to alter their subscription plans without proper authorization or payment. This issue poses a significant risk for unauthorized plan modifications, potentially leading to cost implications for impacted organizations.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.