{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1981", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-05T14:23:11.148Z", "datePublished": "2026-03-06T23:22:59.774Z", "dateUpdated": "2026-04-08T17:16:16.853Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:16:16.853Z"}, "affected": [{"vendor": "winstonai", "product": "HUMN-1 AI Website Scanner & Human Certification by Winston AI", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "0.0.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The HUMN-1 AI Website Scanner & Human Certification by Winston AI plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the winston_disconnect() function in all versions up to, and including, 0.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the plugin's API connection settings via the 'winston_disconnect' AJAX action."}], "title": "Winston AI <= 0.0.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b1a82073-ab63-42dd-9bc0-d21f53a5af25?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/winston-ai-wp/trunk/ajax/Ajax_Admin.php#L38"}, {"url": "https://plugins.trac.wordpress.org/browser/winston-ai-wp/tags/0.0.3/ajax/Ajax_Admin.php#L38"}, {"url": "https://plugins.trac.wordpress.org/browser/winston-ai-wp/trunk/ajax/Ajax_Admin.php#L193"}, {"url": "https://plugins.trac.wordpress.org/browser/winston-ai-wp/tags/0.0.3/ajax/Ajax_Admin.php#L193"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3468726%40winston-ai-wp&new=3468726%40winston-ai-wp"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Abhirup Konwar"}], "timeline": [{"time": "2026-02-09T19:24:52.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-06T11:14:38.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-09T19:00:28.248843Z", "id": "CVE-2026-1981", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T19:34:19.196Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1981", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T19:00:28.248843Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T19:00:29.305Z"}}], "cna": {"title": "Winston AI <= 0.0.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion", "credits": [{"lang": "en", "type": "finder", "value": "Abhirup Konwar"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "winstonai", "product": "HUMN-1 AI Website Scanner & Human Certification by Winston AI", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.0.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-09T19:24:52.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-06T11:14:38.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b1a82073-ab63-42dd-9bc0-d21f53a5af25?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/winston-ai-wp/trunk/ajax/Ajax_Admin.php#L38"}, {"url": "https://plugins.trac.wordpress.org/browser/winston-ai-wp/tags/0.0.3/ajax/Ajax_Admin.php#L38"}, {"url": "https://plugins.trac.wordpress.org/browser/winston-ai-wp/trunk/ajax/Ajax_Admin.php#L193"}, {"url": "https://plugins.trac.wordpress.org/browser/winston-ai-wp/tags/0.0.3/ajax/Ajax_Admin.php#L193"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3468726%40winston-ai-wp&new=3468726%40winston-ai-wp"}], "descriptions": [{"lang": "en", "value": "The HUMN-1 AI Website Scanner & Human Certification by Winston AI plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the winston_disconnect() function in all versions up to, and including, 0.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the plugin's API connection settings via the 'winston_disconnect' AJAX action."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:16:16.853Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1981", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:16:16.853Z", "dateReserved": "2026-02-05T14:23:11.148Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-06T23:22:59.774Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The HUMN-1 AI Website Scanner & Human Certification by Winston AI plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the winston_disconnect() function in all versions up to, and including, 0.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the plugin's API connection settings via the 'winston_disconnect' AJAX action."}, {"lang": "es", "value": "El plugin HUMN-1 AI Website Scanner &amp; Human Certification by Winston AI para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a una comprobaci\u00f3n de capacidad faltante en la funci\u00f3n winston_disconnect() en todas las versiones hasta la 0.0.3, inclusive. Esto hace posible que atacantes autenticados, con acceso de nivel Suscriptor y superior, restablezcan la configuraci\u00f3n de conexi\u00f3n de la API del plugin a trav\u00e9s de la acci\u00f3n AJAX 'winston_disconnect'."}], "id": "CVE-2026-1981", "lastModified": "2026-04-22T21:27:27.950", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2026-03-07T00:16:13.280", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/winston-ai-wp/tags/0.0.3/ajax/Ajax_Admin.php#L193"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/winston-ai-wp/tags/0.0.3/ajax/Ajax_Admin.php#L38"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/winston-ai-wp/trunk/ajax/Ajax_Admin.php#L193"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/winston-ai-wp/trunk/ajax/Ajax_Admin.php#L38"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3468726%40winston-ai-wp&new=3468726%40winston-ai-wp"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b1a82073-ab63-42dd-9bc0-d21f53a5af25?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.0.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "HUMN-1 AI Website Scanner & Human Certification by Winston AI", "source": "cna", "vendor": "winstonai"}, "product": "humn-1_ai_website_scanner_&_human_certification_by_winston_ai", "vendor": "winstonai"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T16:47:00.850860+00:00", "value": {"mitigation_remediation": ["Apply the latest plugin version that implements the missing capability check for the winston_disconnect action.", "Restrict or remove Subscriber\u2011level accounts from WordPress admin or from accessing the plugin\u2019s AJAX endpoints, if possible, to reduce the attack surface.", "As a temporary workaround, edit the plugin\u2019s Ajax_Admin.php file to add a capability check such as current_user_can('manage_options') before executing winston_disconnect, or disable the endpoint entirely for non\u2011admin users."], "summary": {"action": "Update Plugin", "impact": "Unauthorized reset of plugin connection settings"}, "threat_synthesis": {"affected_systems": "WordPress sites that have installed the Winston AI HUMN-1 AI Website Scanner & Human Certification plugin in versions 0.0.3 or earlier. The issue targets any installation of the plugin regardless of other WordPress components, and applies to any user account that holds at least Subscriber privileges.", "description_and_impact": "The HUMN-1 AI Website Scanner & Human Certification plugin for WordPress lacks a capability check in the winston_disconnect() function, allowing any authenticated user with Subscriber or higher privileges to trigger the 'winston_disconnect' AJAX action and reset the plugin's API connection settings. This changes critical configuration data, effectively disrupting the plugin\u2019s operation and potentially disabling site monitoring or certification services. The flaw does not allow generic code execution, but it compromises the integrity and availability of the plugin\u2019s functionality.", "risk_and_exploitability": "With a CVSS score of 4.3, the vulnerability is classified as moderate severity. The EPSS score is reported as less than 1%, indicating a low probability that the flaw will be actively exploited in the wild at this time. The vulnerability is not currently listed in the CISA KEV catalog. Attackers must be authenticated and possess Subscriber or higher role access to the WordPress site. The exploit path requires the ability to send an AJAX request to the winston_disconnect endpoint, a functionality exposed by the plugin. Given these conditions, the risk is limited to sites with legitimate subscriber users and no privilege\u2011elevation mechanism beyond the normal WordPress role hierarchy."}}}}, "created": "2026-03-09T10:06:13.786164+00:00", "updated": "2026-04-15T17:00:07.043789+00:00", "vendors": ["winstonai", "winstonai$PRODUCT$humn-1_ai_website_scanner_&_human_certification_by_winston_ai", "wordpress", "wordpress$PRODUCT$wordpress"]}