CVE-2026-1930 is a missing authorization vulnerability in the Emailchef WordPress plugin by hanicker. The issue arises because the page_options_ajax_disconnect() function lacks a capability check, enabling authenticated users with low privileges (Subscriber and above) to invoke the 'emailchef_disconnect' AJAX action and delete plugin settings. This vulnerability affects all versions up to and including 3.5.1. The CVSS 3.1 score is 4.3, reflecting a medium impact primarily on integrity due to unauthorized modification of plugin data. No patch or official remediation has been published yet.

An attacker with at least Subscriber-level access can delete Emailchef plugin settings without authorization, potentially disrupting plugin functionality or causing configuration loss. There is no direct impact on confidentiality or availability reported. No known exploits are currently documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles carefully to limit Subscriber-level access and monitor for suspicious activity related to the 'emailchef_disconnect' AJAX action. Avoid granting unnecessary authenticated access to untrusted users.