CVE-2026-7456

The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_disconnect()` function in all versions up to, and including, 3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's six configuration options — including the API key, connected Udimi user email, and tracking-script payload — effectively disconnecting the site from the configured Udimi account. The companion `ajax_connect()` handler is missing the same checks, allowing the same low-privilege attackers to overwrite those options with an attacker-supplied API key.

• CWE-862

• https://plugins.trac.wordpress.org/browser/udimi-optin/tags/3.2/class.php#L47
• https://plugins.trac.wordpress.org/browser/udimi-optin/tags/3.2/class.php#L82
• https://plugins.trac.wordpress.org/browser/udimi-optin/tags/3.2/udimi-optin.php#L22
• https://plugins.trac.wordpress.org/browser/udimi-optin/tags/3.2/udimi-optin.php#L23
• https://plugins.trac.wordpress.org/browser/udimi-optin/trunk/class.php#L82
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3525585%40udimi-optin%2Ftrunk&old=3352707%40udimi-optin%2Ftrunk
• https://www.wordfence.com/threat-intel/vulnerabilities/id/263f7a72-8887-42c3-a1df-3dee904f957e?source=cve

Published

Aug 5, 2026

Last Modified

Aug 5, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7448Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-7450A maliciously crafted PAR file, when parsed through Autodesk…5.5
• CVE-2026-7451A maliciously crafted TIF file, when parsed through Autodesk…7.8
• CVE-2026-7452A maliciously crafted WRL file, when parsed through Autodesk…7.8
• CVE-2026-7453A maliciously crafted WRL file, when parsed through Autodesk…5.5
• CVE-2026-7454A maliciously crafted WRL file, when parsed through Autodesk…7.8
• CVE-2026-7457The LatePoint plugin for WordPress is vulnerable to Stored C…6.4
• CVE-2026-7458The User Verification by PickPlugins plugin for WordPress is…9.8
• CVE-2026-7459The Simple History – Track, Log, and Audit WordPress Changes…7.5
• CVE-2026-7460mailcow-dockerized contains a stored cross-site scripting vu…7.4
• CVE-2026-7461Improper neutralization of inputs used in an OS command in t…7.5
• CVE-2026-7462The VatanSMS WP SMS plugin for WordPress is vulnerable to Re…6.1