CVE-2026-1930

Name of the Vulnerable Software and Affected Versions Emailchef versions prior to 3.5.2

Description The plugin is susceptible to unauthorized data modification because the page options ajax disconnect() function lacks a proper capability check. Authenticated users with Subscriber-level permissions or higher can exploit this by using the 'emailchef disconnect' AJAX action to delete plugin settings.

Recommendations Update to a version newer than 3.5.1. As a temporary workaround, restrict access to the 'emailchef disconnect' AJAX action.