What is the CVSS score of EUVD-2026-24718?

EUVD-2026-24718 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Emailchef WordPress Plugin EUVD-2026-24718

| CVE-2026-1930 MEDIUM

Missing Authorization (CWE-862)

2026-04-22 Wordfence

GHSA-vf5m-3cj8-f27q

Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 13:09 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 10:00 euvd

EUVD-2026-24718

Analysis Generated

Apr 22, 2026 - 10:00 vuln.today

CVE Published

Apr 22, 2026 - 09:27 nvd

MEDIUM 4.3

DescriptionCVE.org

The Emailchef plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the page_options_ajax_disconnect() function in all versions up to, and including, 3.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's settings via the 'emailchef_disconnect' AJAX action.

AnalysisAI

Emailchef WordPress plugin versions up to 3.5.1 allow authenticated attackers with Subscriber-level access to delete plugin settings via an unprotected AJAX action due to missing capability checks. The vulnerability enables unauthorized modification of plugin configuration without administrative privileges, affecting any WordPress site using the affected plugin versions. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability exists in the page_options_ajax_disconnect() AJAX handler within the Emailchef plugin's admin class. AJAX actions in WordPress require explicit capability checks to verify user permissions before executing sensitive operations. The 'emailchef_disconnect' AJAX endpoint lacks proper capability validation, allowing any authenticated user - including those with minimal Subscriber-level permissions - to trigger data deletion intended for administrators only. This is a classic WordPress privilege escalation pattern where AJAX handlers bypass the normal admin capability checks that would prevent unauthorized access. CWE-862 (Missing Authorization) identifies the root cause: insufficient permission verification before executing privileged functions.

RemediationAI

Update the Emailchef plugin to a patched version released after 3.5.1 immediately. Access the WordPress plugin dashboard, navigate to Installed Plugins, and upgrade Emailchef to the latest available version. The fix adds proper capability checks to the page_options_ajax_disconnect() function to ensure only administrators can invoke the 'emailchef_disconnect' AJAX action. If a patched version is not yet available, restrict user role permissions by limiting the number of Subscriber-level accounts and disabling public user registration in WordPress settings (Settings → General → Membership). Monitor the plugin's WordPress repository page at https://plugins.trac.wordpress.org/browser/emailchef/ for patch availability. Reapply restrictive role policies after patching to maintain principle of least privilege.