CVE-2025-13381 is a missing authorization vulnerability in the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin (versions up to 2.7.0). The function 'ays_chatgpt_save_wp_media' lacks a capability check, enabling unauthenticated attackers to upload media files. This could lead to unauthorized content uploads, potentially facilitating further attacks or misuse of the site. The vulnerability is classified under CWE-862 and has a CVSS 3.1 score of 5.3 (medium severity). No patch or official fix has been documented in the provided data.

An unauthenticated attacker can upload media files to a vulnerable WordPress site using this plugin, which may allow the attacker to store malicious files or content on the server. While this does not directly lead to confidentiality or availability loss, it impacts integrity by allowing unauthorized content injection. No direct evidence of exploitation or further impact is provided.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to prevent unauthorized media uploads. Monitoring plugin updates from the vendor is recommended to apply any forthcoming patches promptly.