CVE-2026-1336CWE-862

AI ChatBot with ChatGPT and Content Generator by AYS <= 2.7.5 - Missing Authorization to Unauthenticated API Key Modification

Medium · published March 2, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
25.1
In the wild
Unconfirmed
What it is

The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the store_data() and get_chatgpt_api_key() functions in all versions up to, and including, 2.7.5. This makes it possible for unauthenticated attackers to view, modify or delete the plugin's ChatGPT API key.

The vulnerability was partially fixed in version 2.7.5 and fully fixed in version 2.7.6

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00332 · 25.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-03-02T23:22Z
EPSS history
Timeline
  • 02 MAR 23:22Z
    AI ChatBot with ChatGPT and Content Generator by AYS <= 2.7.5 - Missing Authorization to Unauthenticated API Key Modification
    cvelistv5