The GW AI Website Builder WordPress plugin contains a missing capability check in the gwaiwebu_gravitywrite_disconnect_handler() function that processes the gwaiwebu_gravitywrite_disconnect AJAX action. This oversight permits any authenticated user with Subscriber or higher privileges to trigger the disconnect, causing the plugin to detach from its GravityWrite connector. The result is loss of connection to GravityWrite and potential disruption of visual editor functionality, but the flaw does not allow loss.

WordPress sites that have installed the GW AI Website Builder plugin by nandhiniwp, versions up to and including 1.0.1, are vulnerable. Sites with authenticated users holding the Subscriber role or higher who can send AJAX requests to the gwaiwebu_gravitywrite_disconnect endpoint are at risk.

The CVSS base score of 4.3 signifies low severity. The EPSS score of less than 1 % indicates a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector requires an authenticated user with at least Subscriber privileges who can send an AJAX request to the gwaiwebu_gravitywrite_disconnect endpoint. While the flaw can disrupt service by severing the plugin’s connection to GravityWrite, it does not grant remote code execution or widespread data loss.