ConfirmedA court, a regulator or the organization itself has stated the core facts, or the record cites a court or regulator source.
AI Assistant with ChatGPT by AYS plugin – unauthenticated AJAX calls
The AI Assistant with ChatGPT by AYS WordPress plugin version 2.0.9 and earlier contained a missing authorization vulnerability that allowed unauthenticated AJAX calls. The vulnerability was classified as broken access control and fixed in version 2.1.0.
AII-1002-46403View source ↗
What happened
The AI Assistant with ChatGPT by AYS WordPress plugin version 2.0.9 and earlier contained a missing authorization vulnerability that allowed unauthenticated users to make AJAX calls.
Index analysis
The vulnerability is classified as broken access control under OWASP A5 and assigned CWE-862 with a CVSS score of 5.3 (medium severity).
Governance controls
The vulnerability was fixed in plugin version 2.1.0.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.