Unauthorized Data Modification in AYS ChatBot Plugin for WordPress
CVE-2026-1336
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 2 March 2026
What is CVE-2026-1336?
The AYS ChatBot with ChatGPT and Content Generator plugin for WordPress is susceptible to unauthorized data access and modification. This vulnerability arises from inadequate capability checks in the store_data() and get_chatgpt_api_key() functions across all versions up to 2.7.5. As a result, unauthenticated users can potentially view, alter, or delete sensitive information related to the plugin's ChatGPT API key, posing significant risks to the security of WordPress sites utilizing this plugin. Users are encouraged to upgrade to version 2.7.6, which provides a complete fix for this vulnerability.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
AI ChatBot with ChatGPT and Content Generator by AYS * <= 2.7.5
References
CVSS V3.1
Timeline
Vulnerability published
Vulnerability Reserved