Ays Chatgpt Assistant Vulnerabilities

Missing Authorization to Unauthenticated API Key Modification vulnerability

CVSS:

5.3

Affected:

up to 2.7.5

Fixed in:

2.7.6

Disclosed:

Mar 2, 2026

The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the store_data() and get_chatgpt_api_key() functions in all versions up to, and including, 2.7.5. This makes it possible for unauthenticated att...

CVSS:

5.3

Affected:

up to 2.7.5

Fixed in:

2.7.6

Disclosed:

Mar 2, 2026

CVE-2026-1336 on NVD →

[en] Missing Authorization vulnerability in Ays Pro AI ChatBot with ChatGPT and Content Generator by AYS ays-chatgpt-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI ChatBot with ChatGPT and Content Generator by AYS: from n/a through <= 2.7.4.

Affected:

up to 2.7.4

Fix:

No patched version reported

Disclosed:

Feb 19, 2026

CVE-2026-25338 on NVD →

The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.7.4. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 2.7.4

Fixed in:

2.7.5

Disclosed:

Feb 8, 2026

CVE-2026-25338 on NVD →

[en] The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'ays_chatgpt_save_wp_media' function in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to upload media files.

Affected:

up to 2.7.1

Fixed in:

2.7.1

Disclosed:

Nov 27, 2025

CVE-2025-13381 on NVD →

[en] The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.0 via the ays_chatgpt_pinecone_upsert function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations origi...

Affected:

up to 2.7.1

Fixed in:

2.7.1

Disclosed:

Nov 27, 2025

CVE-2025-13378 on NVD →

The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.0 via the ays_chatgpt_pinecone_upsert function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originatin...

CVSS:

6.5

Affected:

up to 2.7.0

Fixed in:

2.7.1

Disclosed:

Nov 26, 2025

CVE-2025-13378 on NVD →

The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'ays_chatgpt_save_wp_media' function in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to upload media files.

CVSS:

5.3

Affected:

up to 2.7.0

Fixed in:

2.7.1

Disclosed:

Nov 26, 2025

CVE-2025-13381 on NVD →

[en] Insertion of Sensitive Information Into Sent Data vulnerability in Ays Pro AI ChatBot with ChatGPT and Content Generator by AYS ays-chatgpt-assistant allows Retrieve Embedded Sensitive Data.This issue affects AI ChatBot with ChatGPT and Content Generator by AYS: from n/a through <= 2.6.6.

Affected:

up to 2.6.7

Fixed in:

2.6.7

Disclosed:

Nov 6, 2025

CVE-2025-62039 on NVD →

The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.6. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

CVSS:

7.5

Affected:

up to 2.6.6

Fixed in:

2.6.7

Disclosed:

Oct 11, 2025

CVE-2025-62039 on NVD →

[en] The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 discloses the Open AI API Key, allowing unauthenticated users to obtain it

Affected:

up to 2.1.0

Fixed in:

2.1.0

Disclosed:

Sep 27, 2024

CVE-2024-7713 on NVD →

[en] The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 lacks sufficient access controls allowing an unauthenticated user to disconnect the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 from OpenAI, thereby disabling the AI ChatBot with ChatGPT an...

Affected:

up to 2.1.0

Fixed in:

2.1.0

Disclosed:

Sep 27, 2024

CVE-2024-7714 on NVD →

The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions like 'ays_chatgpt_disconnect' hooked via an AJAX action ays_chatgpt_admin_ajax in versions up to, and including, 2.0.9. This makes it possible for un...

CVSS:

5.3

Affected:

up to 2.0.9

Fixed in:

2.1.0

Disclosed:

Sep 5, 2024

CVE-2024-7714 on NVD →

The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.9 via the ays_chatgpt_admin_ajax AJAX action. This makes it possible for unauthenticated attackers to retrieve the OpenAI key connected to the site.

CVSS:

5.3

Affected:

up to 2.0.9

Fixed in:

2.1.0

Disclosed:

Sep 5, 2024

CVE-2024-7713 on NVD →