CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
Server-Side Request Forgery (SSRF) vulnerability in aitool Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One ai-auto-tool allows Server Side Request Forgery.This issue affects Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One: from n/a through <= 2.3.3.
Explanation of Vulnerability in Simple Terms
The Ai Auto Tool Content Writing Assistant plugin contains a server-side request forgery vulnerability that allows authenticated users with low privileges to make the site send HTTP requests to internal or external systems on the attacker's behalf. The vulnerability requires high attack complexity and does not require user interaction. An attacker can read sensitive data or modify resources on systems the site can reach, though availability is not affected.
What an attacker can do
Make the site send HTTP requests to internal systems or external servers to read or modify data.
Potential impact on your site
Attackers with plugin access can probe internal networks, steal credentials, or modify data on systems reachable from your server.
Conditions required to exploit
Attacker must have a low-privilege authenticated account; no user interaction required.
Key dates
External resources
Related vulnerabilities
