CVE-2026-8614 is a missing authorization vulnerability (CWE-862) in the Assistio WordPress plugin. The assistio_plugin_delete_assistio_settings() function lacks both capability checks and nonce verification, enabling authenticated users with low privileges (Subscriber-level and above) to delete plugin options, including the 'assistiobot_oauth_settings' option. This unauthorized modification can disrupt the plugin's operation and its integration with the Assistio bot service. The vulnerability affects versions up to and including 1.1.2. No official patch or remediation guidance is currently available from the vendor.

An attacker with authenticated Subscriber-level access or higher can delete critical plugin settings, specifically the 'assistiobot_oauth_settings' option. This results in disruption of the plugin's integration with the Assistio bot service, potentially causing loss of functionality or service interruption. There is no indication of confidentiality or availability impact beyond this disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and monitor for unauthorized changes to plugin settings. Consider disabling or removing the Assistio plugin if the risk is unacceptable.