CVE-2026-1946

Name of the Vulnerable Software and Affected Versions GW AI Website Builder versions prior to 1.0.2

Description The plugin is susceptible to unauthorized data modification because the gwaiwebu gravitywrite disconnect handler() function lacks a proper capability check. Authenticated users with Subscriber-level permissions or higher can exploit this by using the 'gwaiwebu gravitywrite disconnect' AJAX action to disconnect the plugin from GravityWrite.

Recommendations Update the plugin to version 1.0.2 or later. As a temporary mitigation, restrict access to the gwaiwebu gravitywrite disconnect handler() function.