Server-Side Request Forgery Vulnerability in AYS AI ChatBot Plugin for WordPress

CVE-2025-13378

What is CVE-2025-13378?

The AYS AI ChatBot with ChatGPT and Content Generator plugin for WordPress exhibits a vulnerability allowing Server-Side Request Forgery. This flaw exists in all versions up to and including 2.7.0, through the ays_chatgpt_pinecone_upsert function. It enables unauthenticated attackers to send unauthorized web requests to arbitrary external locations, potentially querying and altering information from internal services. This can lead to significant security risks as attackers may exploit this vulnerability to gain access to sensitive internal data or perform unintended operations.

References