CVE-2026-8614

Name of the Vulnerable Software and Affected Versions Assistio versions prior to 1.1.3

Description The Assistio plugin for WordPress allows authenticated users with Subscriber-level access and above to perform unauthorized data modification. This occurs because the assistio plugin delete assistio settings() function lacks a capability check and nonce verification. A nonce is a unique token used to protect against cross-site request forgery. Attackers can exploit this to delete plugin options, specifically the assistiobot oauth settings variable, which breaks the integration with the Assistio bot service.

Recommendations Update the plugin to a version newer than 1.1.2. As a temporary mitigation, restrict access to the assistio plugin delete assistio settings() function for users with Subscriber-level permissions.