Unauthorized Access in AYS Plugin for WordPress
CVE-2025-13381
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 27 November 2025
What is CVE-2025-13381?
The AYS ChatBot with ChatGPT and Content Generator plugin for WordPress is exposed to a security risk stemming from a missing capability check on the 'ays_chatgpt_save_wp_media' function. This vulnerability affects all versions up to and including 2.7.0, allowing unauthenticated attackers to upload media files, potentially leading to further exploitation of the website. Site administrators are urged to update to the latest version to secure their installations.
Affected Version(s)
AI ChatBot with ChatGPT and Content Generator by AYS * <= 2.7.0