CVE-2026-8614
Deferred Deferred - Pending Action

Unauthorized Data Modification in Assistio WordPress Plugin

Publication date: 2026-06-24

Last updated on: 2026-06-24

Assigner: Wordfence

Description
The Assistio plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the assistio_plugin_delete_assistio_settings() function in versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's options including the critical 'assistiobot_oauth_settings' option, which disrupts the plugin's integration with the Assistio bot service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-24
Last Modified
2026-06-24
Generated
2026-07-14
AI Q&A
2026-06-24
EPSS Evaluated
2026-07-13
NVD
CVE-2026-8614
EUVD
EUVD-2026-38668

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
assistio assistio_plugin to 1.1.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Assistio plugin for WordPress has a vulnerability in versions up to and including 1.1.2 where there is a missing capability check and missing nonce verification in the function assistio_plugin_delete_assistio_settings().

This flaw allows authenticated users with Subscriber-level access or higher to delete the plugin's options, including a critical option called 'assistiobot_oauth_settings'.

Deleting these options disrupts the plugin's integration with the Assistio bot service.

Impact Analysis

This vulnerability can impact you by allowing low-privileged authenticated users (Subscribers and above) to delete important plugin settings.

Specifically, deleting the 'assistiobot_oauth_settings' option can disrupt the plugin's connection to the Assistio bot service, potentially causing loss of functionality or service interruptions.

While it does not directly compromise confidentiality or availability, it can lead to integrity issues by unauthorized modification of plugin data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-8614. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart