Description
The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 lacks sufficient access controls allowing an unauthenticated user to disconnect the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 from OpenAI, thereby disabling the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0. Multiple actions are accessible: 'ays_chatgpt_disconnect', 'ays_chatgpt_connect', and 'ays_chatgpt_save_feedback'
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | AI ChatBot with ChatGPT and Content Generator by AYS | < 2.1.0 | 2.1.0 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- AI Assistant with ChatGPT by AYS <= 2.0.9 - Unauthenticated AJAX Calls http/cves/2024/CVE-2024-7714.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://wpscan.com/vulnerability/04447c76-a61b-4091-a510-c76fc8ca5664/ exploit vdb-entry technical-description