The AI ChatBot with ChatGPT and Content Generator by AYS exposes a Server‑Side Request Forgery vulnerability in all versions through the ays_chatgpt_pinecone_upsert function. An unauthenticated attacker can supply a crafted pinecone_url value and force the plugin to send HTTP requests from the WordPress host to arbitrary internal or external destinations. This enables the attacker to read or modify information on internal services, potentially exposing sensitive data or executing further attacks against resident infrastructure.

The vulnerability affects the WordPress plugin AI ChatBot with ChatGPT and Content Generator by AYS in versions 2.7.0 and earlier. No other products or vendors are listed as affected.

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score of less than 1 % reflects a very low probability of exploitation in the wild. The vulnerability is currently not included in the CISA KEV catalog, suggesting no known active exploitation. Based on the description, the likely attack vector is a remote attacker exploiting the plugin’s REST endpoint as an unauthenticated user; the exploit requires only basic HTTP requests and does not depend on privileged access. Detection would involve monitoring outbound traffic originating from the WordPress host to unknown destinations.