PT-2024-38530 · Ays · Ai Chatbot With Chatgpt/Content Generator

Kieran Burge · Published 2024-09-26 · Updated 2024-10-07 · CVE-2024-7714

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin versions prior to 2.1.0

Description The issue is related to insufficient access controls in the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin, allowing an unauthenticated user to disconnect the plugin from OpenAI. This can be achieved through multiple accessible actions: ays chatgpt disconnect, ays chatgpt connect, and ays chatgpt save feedback.

Recommendations For versions prior to 2.1.0, upgrade to version 2.1.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the ays chatgpt disconnect, ays chatgpt connect, and ays chatgpt save feedback actions to prevent unauthorized disconnection from OpenAI.

Exploit

Fix

Related Identifiers

CVE-2024-7714

Affected Products

Ai Chatbot With Chatgpt/Content Generator

References · 8

• 🔥 https://wpscan.com/vulnerability/04447c76-a61b-4091-a510-c76fc8ca5664 · Exploit
• https://osv.dev/vulnerability/CVE-2024-7714 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7714 · Security Note
• https://t.me/cvedetector/6475 · Telegram Post
• https://twitter.com/oktsec/status/1839585174071173543 · Twitter Post
• https://t.me/cvenotify/96276 · Telegram Post
• https://twitter.com/CVEnew/status/1839551384552632483 · Twitter Post
• https://t.me/cvenotify/97256 · Telegram Post