CVE-2025-13381: AI ChatBot with ChatGPT and Content Generator by AYS <= 2.7.0 - Missing Authorization to Unauthenticated Media File Uploads
The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'ayschatgptsavewpmedia' function in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to upload media files.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13381?
CVE-2025-13381 is considered a high severity vulnerability due to unauthorized access risks.
How do I fix CVE-2025-13381?
To fix CVE-2025-13381, update the AYS AI ChatBot with ChatGPT and Content Generator plugin to version 2.8.0 or later.
Who is affected by CVE-2025-13381?
CVE-2025-13381 affects all versions of the AYS AI ChatBot with ChatGPT and Content Generator plugin up to and including version 2.7.0.
What type of vulnerability is CVE-2025-13381?
CVE-2025-13381 is a vulnerability related to unauthorized access due to a missing capability check.
Can CVE-2025-13381 be exploited remotely?
Yes, CVE-2025-13381 can be exploited remotely by unauthenticated attackers.