CVE-2026-1930 is a missing authorization vulnerability in the Emailchef WordPress plugin by hanicker. The issue arises because the page_options_ajax_disconnect() function does not perform a capability check before processing the 'emailchef_disconnect' AJAX action. As a result, any authenticated user with at least Subscriber-level privileges can delete the plugin's settings, potentially disrupting its functionality. This vulnerability affects all versions up to and including 3.5.1. The CVSS 3.1 score is 4.3, reflecting a low complexity attack vector with limited impact on integrity and no impact on confidentiality or availability.

An attacker with Subscriber-level or higher access can delete Emailchef plugin settings, which may disrupt plugin operation or cause loss of configuration data. There is no impact on confidentiality or availability. The vulnerability does not allow privilege escalation beyond the attacker's existing access level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and consider disabling or removing the Emailchef plugin if unauthorized configuration changes pose a significant risk.