CVE-2025-13380

The AI Engine for WordPress: ChatGPT, GPT Content Generator plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1. This is due to insufficient validation of user-supplied file paths in the 'lqdai_update_post' AJAX endpoint and the use of file_get_contents() with user-controlled URLs without protocol restrictions in the insert_image() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

• CWE-73

• https://github.com/d0n601/CVE-2025-13380
• https://plugins.trac.wordpress.org/browser/liquid-chatgpt/tags/1.0.1/liquid-chatgpt.php#L315
• https://plugins.trac.wordpress.org/browser/liquid-chatgpt/tags/1.0.1/liquid-chatgpt.php#L423
• https://plugins.trac.wordpress.org/browser/liquid-chatgpt/tags/1.0.1/liquid-chatgpt.php#L83
• https://ryankozak.com/posts/cve-2025-13380/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ae0abace-9bf6-4ef9-a9b8-7efffbf25628?source=cve

Published

Nov 25, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-13375IBM Common Cryptographic Architecture (CCA) 7.5.52 and 8.4.8…9.8
• CVE-2025-13376The ProjectList plugin for WordPress is vulnerable to arbitr…7.2
• CVE-2025-13377The 10Web Booster – Website speed optimization, Cache & Page…8.1
• CVE-2025-13378The AI ChatBot with ChatGPT and Content Generator by AYS plu…6.5
• CVE-2025-13379IBM Aspera Console 3.4.0 through 3.4.8 is vulnerable to SQL …8.6
• CVE-2025-1338A vulnerability was found in NUUO Camera up to 20250203. It …7.3
• CVE-2025-13381The AI ChatBot with ChatGPT and Content Generator by AYS plu…5.3
• CVE-2025-13382The Frontend File Manager Plugin for WordPress is vulnerable…4.3
• CVE-2025-13383The Job Board by BestWebSoft plugin for WordPress is vulnera…6.1
• CVE-2025-13384The CP Contact Form with PayPal plugin for WordPress is vuln…7.5
• CVE-2025-13385The Bookme – Free Online Appointment Booking and Scheduling …4.9
• CVE-2025-13386The Social Images Widget plugin for WordPress is vulnerable …5.3