The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress suffers from an SSRF vulnerability (CWE-918) in the ays_chatgpt_pinecone_upsert function in versions up to 2.7.0. This flaw enables unauthenticated attackers to induce the server to send HTTP requests to arbitrary locations, potentially allowing them to interact with internal network services or resources that are otherwise inaccessible externally. The vulnerability is publicly known and assigned CVE-2025-13378 with a CVSS 3.1 base score of 6.5, indicating medium severity. There is no information on an available patch or vendor advisory detailing remediation.

An unauthenticated attacker can exploit this SSRF vulnerability to make the vulnerable WordPress plugin's server send arbitrary HTTP requests. This may lead to unauthorized querying or modification of internal services or resources accessible from the server, potentially exposing sensitive information or enabling further attacks within the internal network. The impact is limited to confidentiality and integrity with no direct availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin to prevent exploitation. Monitor official channels for updates from the vendor regarding patches or mitigations.