The vulnerability arises from missing capability checks in the plugin’s store_data() and get_chatgpt_api_key() functions. Because these functions can be invoked without authentication, any party can view, modify, or delete the stored ChatGPT API key. This exposes the site owner’s secret credentials and gives the attacker the ability to hijack or deny the plugin’s ChatGPT functionality. The impact is data compromise and potential remote service abuse through the exposed API key.

All installations of the AI ChatBot with ChatGPT and Content Generator by AYS for WordPress, specifically versions up to and including 2.7.5. Users running 2.7.5 are partially protected, but the issue remains until version 2.7.6 where the fix is complete.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation at present, and the vulnerability is not yet in the CISA KEV catalog. However, the flaw can be exploited via unauthenticated HTTP requests to the plugin’s API endpoints, a vector that is simple and requires no special credentials. Even though the potential impact is limited to API key disclosure, the compromised key can be used for services that may carry monetary costs or privacy risks.