What is the CVSS score of CVE-2026-1946?

CVE-2026-1946 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

GW AI Website Builder CVE-2026-1946

EUVD-2026-42845 MEDIUM

Missing Authorization (CWE-862)

2026-07-10 Wordfence

GHSA-r5vf-wg5q-932h

WordPress Authentication Bypass Wordpress Plugin Gw Ai Website Builder

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible AJAX endpoint requiring only subscriber authentication (PR:L); impact is solely integrity loss from service disconnection with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 09:22 vuln.today

CVE Published

Jul 10, 2026 - 07:48 nvd

MEDIUM 4.3

DescriptionCVE.org

The GW AI Website Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gwaiwebu_gravitywrite_disconnect_handler() function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disconnect the plugin from GravityWrite via the 'gwaiwebu_gravitywrite_disconnect' AJAX action.

AnalysisAI

Unauthorized GravityWrite disconnection in the GW AI Website Builder WordPress plugin (versions ≤ 1.0.1) is achievable by any authenticated subscriber-level user due to a missing capability check on the gwaiwebu_gravitywrite_disconnect_handler() AJAX function. The flaw allows low-privilege WordPress accounts to sever the plugin's integration with the GravityWrite AI service, degrading AI-powered site-building functionality for all users. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; impact is confined to service integrity disruption rather than data exfiltration or code execution.

Technical ContextAI

The root cause is CWE-862 (Missing Authorization) - the gwaiwebu_gravitywrite_disconnect_handler() function, registered as WordPress AJAX action 'gwaiwebu_gravitywrite_disconnect' in API/api-functions.php (lines L4069 and L4253 per WordPress Trac references), omits any call to current_user_can() or equivalent capability verification before executing the disconnect logic. WordPress AJAX handlers must explicitly gate privileged operations behind capability checks; without them, any authenticated session can invoke the action. CPE cpe:2.3:a:nandhiniwp:gw_ai_website_builder:*:*:*:*:*:*:*:* confirms the affected vendor (nandhiniwp) and that all tracked versions through 1.0.1 carry this flaw. The integration target, GravityWrite, is a third-party AI content generation service, so the attack surface is the API connection lifecycle management within the plugin.

RemediationAI

A patch commit (changeset 3481065) has been applied to the WordPress plugin SVN repository, visible at https://plugins.trac.wordpress.org/changeset?reponame=&old=3481065%40gw-ai-website-builder&new=3481065%40gw-ai-website-builder; however, a specific patched release version number beyond 1.0.1 is not independently confirmed from available data - update to the latest available version via the WordPress admin dashboard and verify the installed version exceeds 1.0.1. As a compensating control where immediate update is not feasible, restrict or audit WordPress Subscriber-level accounts to reduce the pool of users who could invoke the AJAX action; disabling open user registration removes unauthenticated paths to obtaining a subscriber account. If the GravityWrite integration is not actively in use, deactivating the plugin entirely eliminates the attack surface at the cost of all AI builder functionality.