Technical impact
The Assistio WordPress plugin contains a missing capability check and nonce verification on the assistio_plugin_delete_assistio_settings() action. As a result, authenticated users with Subscriber-level access or higher can trigger the deletion of all plugin options, including the critical 'assistiobot_oauth_settings', effectively disabling the plugin's integration with the Assistio bot service. This flaw leads to loss of data integrity and a disruption of service for sites that rely on the bot for support and automation.
Affected Systems
The vulnerability affects the Assist.io Assistio plugin for WordPress, impacting all installations of versions up to and including 1.1.2. Sites running any of these versions should verify the current plugin version and upgrade if available.
Risk and Exploitability
The CVSS score is 4.3, indicating a moderate level of severity. EPSS is not available, but the lack of authentication checks and nonce validation means the attack is straightforward for any authenticated user. The flaw is not listed in CISA's KEV catalog, so no active exploitation campaigns have been reported at this time. Nonetheless, any subscriber or higher privileged user can exploit the issue to permanently delete plugin configuration, which may require manual reconfiguration or reinstallation of the plugin.
