Executive Summary

The Assistio plugin for WordPress has a vulnerability in versions up to and including 1.1.2 where there is a missing capability check and missing nonce verification in the function assistio_plugin_delete_assistio_settings().

This flaw allows authenticated users with Subscriber-level access or higher to delete the plugin's options, including a critical option called 'assistiobot_oauth_settings'.

Deleting these options disrupts the plugin's integration with the Assistio bot service.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing low-privileged authenticated users (Subscribers and above) to delete important plugin settings.

Specifically, deleting the 'assistiobot_oauth_settings' option can disrupt the plugin's connection to the Assistio bot service, potentially causing loss of functionality or service interruptions.

While it does not directly compromise confidentiality or availability, it can lead to integrity issues by unauthorized modification of plugin data.

Useful 0 Not Useful 0