PT-2025-48006 · WordPress · Ai Engine For Wordpress: Chatgpt

Ryan Kozak · Published 2025-11-25 · Updated 2025-11-25 · CVE-2025-13380

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AI Engine for WordPress: ChatGPT, GPT Content Generator plugin for WordPress versions up to and including 1.0.1

Description The software contains a flaw that allows authenticated attackers with Contributor-level access or higher to read arbitrary files on the server. This is due to inadequate validation of file paths provided by users in the lqdai update post API endpoint and the use of the file get contents() function with user-controlled URLs lacking protocol restrictions within the insert image() function. This could expose sensitive information contained in those files.

Recommendations Versions prior to and including 1.0.1 should be updated. As a temporary workaround, restrict access to the lqdai update post API endpoint. Avoid using user-controlled URLs with the file get contents() function.

Exploit

Fix

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2025-13380

Affected Products

Ai Engine For Wordpress: Chatgpt

References · 10

• 🔥 https://github.com/d0n601/CVE-2025-13380 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-13380 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/ae0abace-9bf6-4ef9-a9b8-7efffbf25628?source=cve · Note
• https://plugins.trac.wordpress.org/browser/liquid-chatgpt/tags/1.0.1/liquid-chatgpt.php#L83 · Note
• https://plugins.trac.wordpress.org/browser/liquid-chatgpt/tags/1.0.1/liquid-chatgpt.php#L423 · Note
• https://t.me/CVEtracker/38169 · Telegram Post
• https://plugins.trac.wordpress.org/browser/liquid-chatgpt/tags/1.0.1/liquid-chatgpt.php#L315 · Note
• https://ryankozak.com/posts/cve-2025-13380 · Note
• https://twitter.com/VulmonFeeds/status/1993284112140898398 · Twitter Post
• https://twitter.com/CVEnew/status/1993225824544473508 · Twitter Post