webocoders vulnerabilities and threats

The Udimi Tools WordPress plugin up to version 3.2 contains a missing authorization vulnerability in its ajax_disconnect() and ajax_connect() functions. Authenticated users with Subscriber-level access or higher can delete or overwrite critical plugin configuration options, including the API key and connected user email, disconnecting the site from the Udimi account or replacing it with attacker-controlled data.