Security Alert Summary
The Emailchef plugin for WordPress contains a vulnerability that allows authenticated users with Subscriber-level access and higher to delete the plugin’s settings via an AJAX action. The issue is caused by a missing capability check in the plugin’s AJAX handler, enabling low-privilege authenticated users to perform an unauthorized modification of plugin data.
CVE Details
- CVE ID: CVE-2026-1930
- Affected component: Emailchef plugin for WordPress
- Affected versions: all versions up to, and including, 3.5.1
- Published: April 22, 2026 at 10:16:51 AM
- Last modified: April 22, 2026 at 10:16:51 AM
- CVSS v3.1: Base score 4.3 (MEDIUM) – vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Authentication / Privileges / User interaction: Requires an authenticated user with Subscriber-level access or higher. Privileges required: LOW. User interaction: NONE.
- Impact (Confidentiality / Integrity / Availability): Confidentiality: NONE; Integrity: LOW; Availability: NONE.
- Weakness: CWE-862 (Missing Authorization)
Technical Details
The plugin contains a missing capability check in the page_options_ajax_disconnect() function. Because that check is absent, the AJAX action emailchef_disconnect can be invoked by an authenticated user with Subscriber-level privileges or greater to delete the plugin’s settings. The vulnerability is an authorization/permission validation issue that allows an authenticated low-privilege user to perform an action that should be restricted.
The direct impact, as described, is deletion of the plugin’s settings via the named AJAX action. The issue exists because the code does not verify user capabilities before performing the disconnect operation.
How This Could Impact Your Website
In a realistic scenario, a site owner maintains an Emailchef integration for sending newsletters. Internal staff (editors) and an external contractor (contributor or subscriber-level account) all have accounts on the site. If a subscriber-level account is compromised or a low-privilege user intentionally triggers the vulnerable AJAX action, the Emailchef plugin settings could be deleted. This may interrupt email delivery, disconnect integrations, and require reconfiguration by the site owner or administrator.
Consequences are primarily operational: disrupted email workflows, lost configuration that needs restoration, and administrative overhead to reconfigure the plugin. There is no confirmed confidentiality impact in the CVSS data for this issue.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially Contributor and Subscriber accounts that are not required.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and logs for unusual behavior, including unexpected AJAX calls or sudden changes to plugin settings.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/emailchef/tags/3.5.1/admin/class-emailchef-admin.php#L121
- https://plugins.trac.wordpress.org/browser/emailchef/tags/3.5.1/admin/class-emailchef-admin.php#L200
- https://plugins.trac.wordpress.org/browser/emailchef/trunk/admin/class-emailchef-admin.php#L121
- https://plugins.trac.wordpress.org/browser/emailchef/trunk/admin/class-emailchef-admin.php#L200
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3474353%40emailchef&new=3474353%40emailchef&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3ae02595-17f0-472d-bc4f-6169cce7a583?source=cve
