CVE-2026-8615 describes a missing authorization vulnerability (CWE-862) in the ilGhera Reviso Exporter for WooCommerce plugin for WordPress. The disconnect_callback() function, registered to the 'wp_ajax_wcefr-disconnect' AJAX action, does not perform capability checks or nonce verification before unconditionally deleting the 'wcefr-agt' option, which stores the Reviso Agreement Grant Token. Authenticated attackers with at least Subscriber-level privileges can exploit this to delete the token, disrupting the integration between WooCommerce and the Reviso service. The vulnerability affects versions up to and including 1.2.3. No patch or official remediation has been documented as of the published date.

The vulnerability allows authenticated users with low-level privileges (Subscriber and above) to delete the plugin's stored Agreement Grant Token, which is essential for authenticating API calls to the Reviso service. This results in denial of service of the integration between WooCommerce and Reviso, potentially disrupting business operations relying on this connection. There is no direct confidentiality or availability impact beyond breaking the API connection. The CVSS score is 4.3 (medium severity), reflecting low complexity and limited impact confined to integrity of the plugin's stored token.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and monitor for unauthorized AJAX requests targeting 'wp_ajax_wcefr-disconnect'. Consider implementing custom capability checks or nonce verification as a temporary mitigation to prevent unauthorized token deletion.