Threat database

The Emailchef WordPress plugin up to version 3.5.1 contains a vulnerability due to missing authorization checks in the page_options_ajax_disconnect() function. This flaw allows authenticated users with Subscriber-level access or higher to delete the plugin's settings via a specific AJAX action. The vulnerability is classified as CWE-862 (Missing Authorization). It has a CVSS 3.1 base score of 4.3, indicating medium severity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.