CVE-2026-7456

Name of the Vulnerable Software and Affected Versions Udimi Tools versions prior to 3.3

Description The Udimi Tools plugin for WordPress allows authenticated users with Subscriber-level access and above to perform unauthorized data modifications. This is caused by missing capability checks in the ajax disconnect() and ajax connect() functions. An attacker can use ajax disconnect() to delete six configuration options, such as the API key, connected Udimi user email, and tracking-script payload, which disconnects the site from the Udimi account. Additionally, the ajax connect() function allows attackers to overwrite these configuration options with an attacker-supplied API key.

Recommendations Update Udimi Tools to version 3.3 or later. As a temporary workaround, restrict access to the ajax disconnect() and ajax connect() functions.