CVE-2026-7456
Received Received - Intake

Unauthorized Data Modification in Udimi Tools WordPress Plugin

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Wordfence

Description
The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_disconnect()` function in all versions up to, and including, 3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's six configuration options — including the API key, connected Udimi user email, and tracking-script payload — effectively disconnecting the site from the configured Udimi account. The companion `ajax_connect()` handler is missing the same checks, allowing the same low-privilege attackers to overwrite those options with an attacker-supplied API key.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-7456
EUVD
EUVD-2026-53338

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
udimi tools to 3.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Udimi Tools WordPress plugin has a vulnerability due to missing capability checks in the ajax_disconnect() function. This allows authenticated attackers with Subscriber-level access or higher to delete or modify the plugin's configuration options, including API keys and user emails, effectively disconnecting the site from its Udimi account.

Detection Guidance

This vulnerability can be detected by checking for unauthorized modifications to the Udimi Tools plugin's configuration options. Look for changes to the API key, connected Udimi user email, or tracking-script payload in the WordPress database or plugin settings. Review WordPress user roles to ensure no Subscriber-level or higher accounts have made unexpected changes.

Impact Analysis

An attacker could disconnect your site from its Udimi account, delete API keys, or replace them with malicious ones. This could disrupt services relying on Udimi integration and potentially expose your site to further attacks if tracking scripts are altered.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, potentially violating GDPR (data protection) or HIPAA (health data privacy) if sensitive configuration data is exposed or altered. Compliance may be impacted if the plugin handles user data or tracking scripts.

Mitigation Strategies

Immediately update the Udimi Tools plugin to the latest version if available. Remove or disable the plugin if no update is available. Review and restrict WordPress user roles to limit Subscriber-level access. Check plugin configuration for unauthorized changes and reset the API key if compromised.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-7456. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart