AI ChatBot with ChatGPT and Content Generator by AYS Missing Authorization Vulnerability in WordPress Plugin

A vulnerability exists in the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin, in versions through 2.7.5. The issue arises from inadequate capability checks in the store_data() and get_chatgpt_api_key() functions, allowing unauthorized access and modification of data. This flaw enables unauthenticated attackers to view, alter, or delete the plugin's ChatGPT API key. While version 2.7.5 addressed part of this vulnerability, it was not until version 2.7.6 that a complete fix was implemented.

Impact

Exploitation of this vulnerability allows for unauthorized access to, and modification of, the ChatGPT API key used by the plugin, potentially leading to unauthorized actions or data manipulation via the ChatGPT API.

Remediation

Users are advised to update the plugin to version 2.7.6 or a newer patched version.