CVE-2025-62039CWE-201

CVE-2025-62039

High · published November 6, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
70.9
In the wild
Unconfirmed
What it is

⚡ Ays Pro AI ChatBot has a sneaky flaw that lets sensitive data escape in plain sight! 🚨 Think of it like a waiter accidentally dropping a stack of bills and receipts on the way to your table — sensitive information is slipping through the cracks when it shouldn't! An attacker could retrieve sensitive data embedded in the chatbot's responses, potentially exposing personal information or confidential discussions. This could lead to breaches of privacy and trust, so safeguarding user data is absolutely crucial in this scenario!

Put simply

Think of it like a waiter accidentally dropping a stack of bills and receipts on the way to your table — sensitive information is slipping through the cracks when it shouldn't! This vulnerability allows sensitive information to be included in the data sent back by the Ays Pro AI ChatBot, which may be unintentionally disclosed during interaction. The flaw affects versions up to and including 2.6.6, meaning unpatched installations are at risk.

What to do

An attacker could retrieve sensitive data embedded in the chatbot's responses, potentially exposing personal information or confidential discussions. This could lead to breaches of privacy and trust, so safeguarding user data is absolutely crucial in this scenario! To remediate this issue, update the ChatBot to the latest version immediately. Review and sanitize any data being sent to users to ensure sensitive information isn't being inadvertently included. Regularly audit your chatbot's interactions to catch similar issues in the future. You've got this! Keep your users safe and secure by following these steps! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01333 · 70.9th percentile
Weakness
CWE-201 · Insertion of Sensitive Information Into Sent Data
Published
2025-11-06T21:16Z
References (1)
EPSS history
Timeline
  • 06 NOV 15:55Z
    WordPress AI ChatBot with ChatGPT and Content Generator by AYS plugin <= 2.6.6 - Sensitive Data Exposure vulnerability
    cvelistv5