CVE-2025-13378

20th percentile - higher than 20% of all known CVEs

The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress in all versions up to and including 2.7.0 is vulnerable to Server-Side Request Forgery via the ays_chatgpt_pinecone_upsert function. This allows unauthenticated attackers to make web requests to arbitrary locations from the application server and to query and modify information from internal services.

An unauthenticated attacker can use the WordPress server to scan the internal network and interact with internal services, potentially leading to data disclosure or modification. The risk is high in environments with access to internal APIs.

Update the plugin to a version later than 2.7.0 if available, or disable it. Restrict outbound network connections from the WordPress server and segment the network.