The Emailchef WordPress plugin contains a missing capability check in the page_options_ajax_disconnect() routine. As a result, any authenticated user with Subscriber level permissions or higher can invoke the emailchef_disconnect AJAX action and delete the plugin’s configuration data, which may break email functionality and cause service disruption. This flaw is a classic authorization bypass, classified as CWE-862, and it does not allow exploitation to execute arbitrary code or gain higher privileges. The primary impact is loss of configuration integrity and potential downtime for sites relying on Emailchef for email handling.

The vulnerability affects all releases of the Emailchef plugin from the earliest version through 3.5.1 released by the vendor hanicker:Emailchef. Systems running any of these versions on WordPress are exposed unless the plugin is removed or updated to a version later than 3.5.1.

The CVSS score for this issue is 4.3, placing it in the medium range. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need an authenticated session and Subscriber or higher access, which is relatively common in many WordPress sites. While the vulnerability does not provide direct code execution, deletion of configuration may lead to service disruption. Given the available attack vector, administrators should treat this issue as a priority to prevent service disruption.