Security readout for executives and security teams
Plain-English summary
CVE-2026-1981 affects the Winston AI HUMN-1 WordPress plugin through version 0.0.3. Any logged-in user, even a Subscriber, could disconnect/reset the plugin’s API connection settings. This is not a data theft issue, but it can disrupt the plugin’s operation and undermine website scanning or certification workflows.
Executive priority
Treat as a routine but timely WordPress plugin remediation. Prioritize sites with public registration, many Subscriber users, or business reliance on Winston AI scanning/certification features.
Technical view
The plugin’s winston_disconnect() AJAX action lacks a proper capability check. Because authenticated low-privilege users can invoke the action, they can reset plugin API connection settings. The issue is classified as CWE-862 with CVSS 4.3, network exploitable, low complexity, requiring low privileges and no user interaction.
Likely exposure
Exposure is limited to WordPress sites running HUMN-1 AI Website Scanner & Human Certification by Winston AI versions up to 0.0.3, where untrusted or broadly available Subscriber-level accounts exist.
Exploitation context
No active exploitation is indicated by KEV or the supplied sources. Abuse requires a valid authenticated WordPress account. The observed impact is integrity loss: plugin connection settings can be reset, potentially interrupting dependent service functionality.
Researcher notes
The evidence points to missing authorization around the winston_disconnect() AJAX action in Ajax_Admin.php. The public references include source locations and a WordPress Trac changeset. The supplied bundle does not clearly state a fixed version, so remediation should be tied to vendor/plugin repository guidance.
Mitigation direction
- Check vendor or WordPress plugin guidance for a fixed release beyond version 0.0.3.
- Update the plugin if a fixed version is available.
- Disable the plugin if it is not needed or cannot be safely updated.
- Restrict Subscriber account creation and remove unnecessary low-privilege users.
- Review plugin API connection settings after remediation.
Validation and detection
- Inventory WordPress sites for the winston-ai-wp plugin.
- Confirm whether installed versions are 0.0.3 or earlier.
- Review the AJAX handler for capability checks on winston_disconnect().
- Check logs for unexpected plugin disconnect or settings reset events.
- Verify the plugin remains connected after applying remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-1981 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N2.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b1a82073-ab63-42dd-9bc0-d21f53a5af25?source=cveCVE reference
- https://plugins.trac.wordpress.org/browser/winston-ai-wp/trunk/ajax/Ajax_Admin.php#L38CVE reference
- https://plugins.trac.wordpress.org/browser/winston-ai-wp/tags/0.0.3/ajax/Ajax_Admin.php#L38CVE reference
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3468726%40winston-ai-wp&new=3468726%40winston-ai-wpCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.