CVE-2026-7617 is a missing authorization vulnerability (CWE-862) in the Secufor_OAuth plugin for WordPress. All versions up to and including 1.0.7 are affected. The plugin fails to verify that a user is authorized to perform certain actions, enabling unauthenticated attackers to clear the plugin's stored login token and user login configuration. This results in the WordPress site being disconnected from its linked Secufor account without requiring authentication. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but with integrity impact limited to the plugin's configuration.

An unauthenticated attacker can disrupt the integration between the WordPress site and the Secufor service by clearing stored authentication tokens and user login configurations. This causes loss of linkage to the Secufor account, potentially interrupting functionality dependent on this connection. There is no direct confidentiality or availability impact reported, but integrity of the plugin's configuration is compromised.

No official patch or remediation has been confirmed or published by the vendor as of the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the WordPress admin interface and monitor for suspicious activity related to the Secufor_OAuth plugin. Avoid exposing the plugin's endpoints to unauthenticated users where possible.