The HUMN-1 AI Website Scanner & Human Certification plugin for WordPress lacks a capability check in the winston_disconnect() function, allowing any authenticated user with Subscriber or higher privileges to trigger the 'winston_disconnect' AJAX action and reset the plugin's API connection settings. This changes critical configuration data, effectively disrupting the plugin’s operation and potentially disabling site monitoring or certification services. The flaw does not allow generic code execution, but it compromises the integrity and availability of the plugin’s functionality.

WordPress sites that have installed the Winston AI HUMN-1 AI Website Scanner & Human Certification plugin in versions 0.0.3 or earlier. The issue targets any installation of the plugin regardless of other WordPress components, and applies to any user account that holds at least Subscriber privileges.

With a CVSS score of 4.3, the vulnerability is classified as moderate severity. The EPSS score is reported as less than 1%, indicating a low probability that the flaw will be actively exploited in the wild at this time. The vulnerability is not currently listed in the CISA KEV catalog. Attackers must be authenticated and possess Subscriber or higher role access to the WordPress site. The exploit path requires the ability to send an AJAX request to the winston_disconnect endpoint, a functionality exposed by the plugin. Given these conditions, the risk is limited to sites with legitimate subscriber users and no privilege‑elevation mechanism beyond the normal WordPress role hierarchy.