CVE-2026-7456 is a missing authorization vulnerability (CWE-862) in the Udimi Tools WordPress plugin by webocoders. The ajax_disconnect() function lacks a capability check, enabling authenticated attackers with low privileges (Subscriber and above) to delete six configuration options such as the API key, user email, and tracking script payload. Similarly, the ajax_connect() function is also missing authorization checks, allowing these attackers to overwrite these options with arbitrary values. This vulnerability affects all versions up to and including 3.2 of the plugin.

An attacker with Subscriber-level access can disrupt the plugin's operation by deleting configuration data, disconnecting the site from the Udimi account, or can maliciously overwrite the API key and related options. This compromises the integrity of the plugin's configuration but does not impact confidentiality or availability directly. The CVSS 3.1 score is 6.5 (medium severity), reflecting the low privilege required and the high impact on integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Subscriber-level access to trusted users only and monitor for suspicious changes to plugin configuration. Avoid granting unnecessary privileges to low-level authenticated users.