EUVD-2026-38668
GHSA-m3g5-vj32-6hcw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network AJAX endpoint reachable by any Subscriber (PR:L, AV:N, AC:L); impact is settings deletion only, no confidentiality or code execution path (C:N, A:N, I:L).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Assistio plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the assistio_plugin_delete_assistio_settings() function in versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's options including the critical 'assistiobot_oauth_settings' option, which disrupts the plugin's integration with the Assistio bot service.
AnalysisAI
Unauthorized settings deletion in the Assistio WordPress plugin (versions ≤ 1.1.2) allows any authenticated Subscriber-level user to invoke the assistio_plugin_delete_assistio_settings() function and wipe critical plugin options, including the 'assistiobot_oauth_settings' OAuth token, breaking the site's Assistio bot integration. The function lacks both WordPress capability verification and nonce validation - two standard WordPress security controls - meaning the authorization boundary is entirely absent. No public exploit has been identified at time of analysis and no CISA KEV listing exists; the CVSS score of 4.3 accurately reflects the limited but real integrity impact against low-privilege authenticated attackers.
Technical ContextAI
The Assistio plugin integrates WordPress with the Assistio AI chatbot service using OAuth credentials stored in the WordPress options table under the key 'assistiobot_oauth_settings'. The vulnerable function assistio_plugin_delete_assistio_settings() (assistio.php, lines ~346-350 in the 1.1.2 tag) is accessible via WordPress AJAX but performs no current_user_can() capability check and no wp_verify_nonce() call before executing options deletion. CWE-862 (Missing Authorization) is the precise root cause: the function processes privileged administrative actions without confirming the calling user holds a sufficient role. The CPE string cpe:2.3:a:assistioai:assistio:*:*:*:*:*:*:*:* covers all versions through 1.1.2 as the affected range. This is a textbook WordPress plugin authorization bypass pattern, commonly arising when AJAX handlers are wired without the standard access-control boilerplate.
RemediationAI
The primary fix is to update the Assistio plugin to a version beyond 1.1.2 once a patched release is published; no vendor-released patched version has been independently confirmed at time of analysis, and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/754f9598-3b41-4fe3-b290-8422031991a8 should be monitored for patch availability. As an immediate compensating control, administrators should disable open user registration to prevent untrusted parties from obtaining Subscriber-level accounts, which is the access gate for exploitation; note that this may impact intended site functionality if registration is required. If the Assistio bot integration is not actively in use, deactivating or fully removing the plugin eliminates the exposure with no functional trade-off. Administrators should also audit existing Subscriber accounts to ensure no untrusted users are enrolled on affected installations.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today