CVE-2026-1981 is a missing authorization vulnerability (CWE-862) in the HUMN-1 AI Website Scanner & Human Certification plugin by Winston AI for WordPress. The vulnerability arises because the winston_disconnect() function lacks a capability check, enabling authenticated users with minimal privileges (Subscriber-level and above) to reset API connection settings through the 'winston_disconnect' AJAX action. This could lead to unauthorized modification of plugin configuration data. The issue affects all plugin versions up to 0.0.3. The CVSS 3.1 base score is 4.3, indicating medium severity. No patch or official fix is currently documented.

An attacker with at least Subscriber-level access can reset the plugin's API connection settings without proper authorization. This unauthorized modification could disrupt the plugin's normal operation or potentially degrade security controls relying on the plugin's API connection. There is no indication of confidentiality or availability impact. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals only and monitor for unauthorized changes to plugin settings. Avoid granting Subscriber-level or higher access to untrusted users. Review and harden WordPress user permissions as a precaution.