CVE-2026-7456: Udimi Tools <= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action
The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxdisconnect() function in all versions up to, and including, 3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's six configuration options — including the API key, connected Udimi user email, and tracking-script payload — effectively disconnecting the site from the configured Udimi account. The companion ajaxconnect() handler is missing the same checks, allowing the same low-privilege attackers to overwrite those options with an attacker-supplied API key.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Udimi Tools pluginto a version that resolves this vulnerability.Fixed in 3.2 - Configuration
Update the plugin to ensure ajax_disconnect() performs a capability check before allowing deletion of the six configuration options (including the API key and tracking-script payload).
WordPress Udimi Tools plugin ajax_disconnect() authorization/capability check = Add missing capability check so only authorized users (above Subscriber-level, as appropriate) can execute the 'disconnect' AJAX handler - Configuration
Update the plugin so ajax_connect() also performs the same capability check to prevent low-privilege authenticated attackers from overwriting options (API key, connected Udimi user email, and related settings) with attacker-supplied values.
WordPress Udimi Tools plugin ajax_connect() authorization/capability check = Add missing capability check so only authorized users can execute the 'connect' AJAX handler
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7456?
The severity of CVE-2026-7456 is rated as medium with a score of 6.5.
How do I fix CVE-2026-7456?
To fix CVE-2026-7456, update the Udimi Tools plugin to the latest version that includes the necessary capability checks.
Who is affected by CVE-2026-7456?
CVE-2026-7456 affects authenticated users with Subscriber-level access and above on sites using the Udimi Tools plugin.
What kind of attack can occur due to CVE-2026-7456?
Due to CVE-2026-7456, authenticated attackers can unauthorizedly modify plugin configuration settings via the 'disconnect' AJAX action.
Is CVE-2026-7456 exploitable remotely?
Yes, CVE-2026-7456 can be exploited remotely as it targets authenticated users with vulnerable plugin access.