CVE-2026-7456 describes a missing authorization (CWE-862) vulnerability in the Udimi Tools WordPress plugin by webocoders. The ajax_disconnect() and ajax_connect() AJAX handlers lack proper capability checks, allowing authenticated users with low privileges (Subscriber and above) to delete or overwrite six key plugin configuration options. These options include the API key, connected Udimi user email, and tracking-script payload. This flaw enables unauthorized modification of plugin settings, effectively disconnecting the site from the legitimate Udimi account or substituting attacker-supplied credentials. The vulnerability affects all versions up to and including 3.2. No official patch or remediation has been documented as of the publication date.

The vulnerability allows low-privileged authenticated users to modify critical plugin configuration data without proper authorization. This can disrupt the integration between the WordPress site and the Udimi service by deleting or replacing the API key and related settings. While it does not directly impact confidentiality or availability, it has a high impact on integrity by enabling unauthorized changes to plugin data, potentially leading to loss of legitimate functionality or malicious manipulation of tracking and account linkage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level user access where possible and monitor for suspicious changes to plugin configuration. Avoid granting unnecessary authenticated access to untrusted users. Follow vendor updates for any forthcoming patches or official mitigations.