EUVD-2026-53338
GHSA-fjcf-648f-mmhx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-accessible AJAX handlers require only subscriber authentication (PR:L); integrity is fully compromised via config overwrite, but no confidentiality exposure or availability disruption applies.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_disconnect() function in all versions up to, and including, 3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's six configuration options - including the API key, connected Udimi user email, and tracking-script payload - effectively disconnecting the site from the configured Udimi account. The companion ajax_connect() handler is missing the same checks, allowing the same low-privilege attackers to overwrite those options with an attacker-supplied API key.
AnalysisAI
Unauthorized configuration takeover in the Udimi Tools WordPress plugin (≤ 3.2) is possible for any subscriber-level authenticated user due to missing capability checks on both the ajax_disconnect() and ajax_connect() AJAX handlers. An attacker with a valid low-privilege WordPress account can wipe the site's Udimi API key and connected account settings, then replace them with attacker-controlled credentials - effectively hijacking the site's Udimi solo-ad integration and redirecting lead tracking data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress session at Subscriber level or above - the lowest possible authenticated role. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 Medium score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) accurately reflects the threat profile: network-reachable, low complexity, but gated behind subscriber-level authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a free subscriber account on a target WordPress site that has open user registration enabled and runs Udimi Tools ≤ 3.2. Using their authenticated session cookie, they send a direct POST request to `/wp-admin/admin-ajax.php` invoking `ajax_disconnect` to erase the existing API key and configuration, then a second POST invoking `ajax_connect` with an attacker-owned Udimi API key - redirecting all lead and tracking data from the victim site's campaigns to the attacker's Udimi account. … |
| Remediation | An upstream fix has been committed to the plugin's trunk branch (trac changeset https://plugins.trac.wordpress.org/changeset?reponame=&new=3525585%40udimi-optin%2Ftrunk&old=3352707%40udimi-optin%2Ftrunk), but a tagged release version number containing the fix is not independently confirmed from available data - administrators should check the WordPress plugin repository for a version newer than 3.2 and update immediately when available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today