CVE-2026-25338: 
WordPress vulnerability analysis and mitigation

CVE-2026-25338 is a Missing Authorization (Broken Access Control) vulnerability in the "AI ChatBot with ChatGPT and Content Generator by AYS" WordPress plugin developed by Ays Pro. It affects all versions up to and including 2.7.4, and was patched in version 2.7.5. The vulnerability was reported on January 9, 2026, and published by Patchstack on February 8, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before executing certain privileged actions. An unauthenticated remote attacker can exploit incorrectly configured access control security levels to invoke functionality that should be restricted to higher-privileged users. No authentication, user interaction, or special preconditions are required for exploitation, as the attack vector is network-accessible with low complexity (Patchstack).

Successful exploitation of this vulnerability allows an unauthenticated attacker to perform unauthorized actions that would normally require elevated privileges, resulting in a low integrity impact with no confidentiality or availability impact. The scope is unchanged, meaning the impact is confined to the vulnerable WordPress plugin component itself. While the severity is rated medium, Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously (Patchstack).

No public proof-of-concept exploit code or confirmed in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017%, indicating a low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies the priority as low, noting it is unlikely to be actively exploited, though the unauthenticated attack vector and mass-exploit campaign potential for WordPress plugins warrants attention (Patchstack).

The vendor has released version 2.7.5 of the "AI ChatBot with ChatGPT and Content Generator by AYS" plugin, which resolves this vulnerability. Site administrators should update the plugin to version 2.7.5 or later immediately via the WordPress admin dashboard. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, site owners should consult their hosting provider or web developer for assistance (Patchstack).