Executive brief
The Assistio plugin for WordPress, which integrates AI bot services into websites, contains a security flaw that allows low-level users to delete its configuration settings. An attacker with a basic subscriber account could reset the plugin's connection to the Assistio service, effectively disabling the bot functionality on the site. This can lead to service disruption and require administrative intervention to restore the integration.
Technical details
The vulnerability exists in the assistio_plugin_delete_assistio_settings() function due to a lack of authorization (missing capability check) and a lack of CSRF protection (missing nonce verification). Authenticated attackers with Subscriber-level permissions or higher can trigger this function via a network request to delete the plugin's options, specifically the 'assistiobot_oauth_settings'. This results in the loss of OAuth configuration and disrupts the plugin's connection to the Assistio bot service. The issue affects all versions up to and including 1.1.2.
Affected products
- assistioai Assistio <= 1.1.2
Timeline
- 2026-06-24: disclosed: Vulnerability published by Wordfence and NVD.