{"data":{"id":"a58ac249-6875-476c-8afa-40af39c2a12b","title":"CVE-2025-13381: The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access due…","summary":"CVE-2025-13381 is a missing authorization flaw (CWE-862) in the AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress, affecting all versions up to and including 2.7.0. The missing capability check on the 'ays_chatgpt_save_wp_media' function lets unauthenticated attackers upload media files. NVD had not yet provided an assessment at the time of publication.","solution":"The source references a fix in the WordPress plugin changeset for tags/2.7.1 (plugin version 2.7.1), but does not explicitly state a fixed version or recommendation.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-13381","publishedAt":"2025-11-27T15:15:51.220Z","cveId":"CVE-2025-13381","cweIds":["CWE-862"],"cvssScore":"5.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["AI ChatBot with ChatGPT and Content Generator by AYS","ChatGPT"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00305,"epssCheckedAt":"2026-11-04T12:08:35.001Z","kevDateAdded":null,"advisoryAliases":["GHSA-chgh-px95-cw3h"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-04T06:10:28.675Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-122"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}