Skip to content
Submit incident
AII-1002-46381
ConfirmedA court, a regulator or the organization itself has stated the core facts, or the record cites a court or regulator source.

AI Chatbot with ChatGPT by AYS plugin - unauthenticated OpenAI key disclosure

A vulnerability in the AI Chatbot with ChatGPT by AYS WordPress plugin versions 2.0.9 and below allowed unauthenticated disclosure of OpenAI API keys. The vulnerability was assigned CVE-2024-7713 and fixed in version 2.1.0.

5 September 2024 · AYS · Security and cyberattacks
5 September 2024

Drafted by Raidu Incident Detection, an automated system.

AII-1002-46381View source ↗
Quick facts
Organization
AYS (subject)
Category
Security and cyberattacks
Source
wpscan.com
Date
5 September 2024
Drafted by
Raidu Incident Detection

What happened

The AI Chatbot with ChatGPT by AYS WordPress plugin in versions 2.0.9 and below contained a vulnerability that allowed unauthenticated disclosure of OpenAI API keys.

Reported impact

Attackers could access OpenAI API keys without authentication, potentially enabling unauthorized use of the API and associated costs or data access.

Index analysis

The vulnerability was classified as sensitive data exposure (CWE-200) with a CVSS score of 7.5 (high severity). The issue was discovered by Kieran Burge of Prism InfoSec.

Governance controls

AYS released version 2.1.0 with a fix for the vulnerability.

Classification

Organization
AYS (subject)
Category
Security and cyberattacks
Harm status
Potential harm
Intent
Unintentional
Timing
Post-deployment
Harmed
Business, Consumers
Failure modes
Data leak
AI systems
AI Chatbot with ChatGPT by AYS

Sources and evidence

This record was researched and written by the Index, based on the following original reporting.

wpscan.com
https://wpscan.com/vulnerability/061eab97-4a84-4738-a1e8-ef9a1261ff73/