CVE-2025-13381

MediumCVSS 5.3

Published: 27/11/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress in versions up to 2.7.0 is vulnerable to unauthorized access due to a missing capability check on the 'ays_chatgpt_save_wp_media' function. This allows unauthenticated attackers to upload media files.

Risk Assessment

An unauthenticated attacker can upload arbitrary media files to the server, potentially leading to storage exhaustion, distribution of malicious content, or other attacks.

Recommendation

Update the plugin to a patched version or restrict access to the 'ays_chatgpt_save_wp_media' function.

Other vulnerabilities in AI ChatBot with ChatGPT and Content Generator by AYS

CVE-2025-13378Medium
The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress in all versions up to and including 2.7.0 is vulnerable to Server-Side Request Forgery via the ays_chatgpt_pinecone_upsert function. This allows unauthenticated attackers to make web requests to arbitrary locations from the application server and to query and modify information from internal services.

Original NVD description (English source)

The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'ays_chatgpt_save_wp_media' function in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to upload media files.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS