CVE-2026-1946: GW AI Website Builder Missing Authorization Flaw Allows Plugin Disconnection

Technical summary

CVE-2026-1946 stems from a missing capability check in the gwaiwebu_gravitywrite_disconnect_handler() function within the GW AI Website Builder plugin for WordPress (versions ≤1.0.1). The vulnerable AJAX action 'gwaiwebu_gravitywrite_disconnect' fails to validate whether the authenticated user has sufficient privileges before processing disconnection requests. Because WordPress 'Subscriber' accounts are authenticated users, they can invoke this action, leading to unauthorized modification of plugin state. The vulnerability is classified as CWE-862 (Missing Authorization), reflecting the absence of privilege-level verification before a privileged operation.

Business impact

Disruption to GravityWrite integration can interrupt workflows that depend on the plugin's form-building or data synchronization features. Malicious low-privilege users could sever the connection between the website builder and its backend service, forcing administrators to re-establish connections and investigate suspicious account activity. While the CVSS score (4.3/MEDIUM) reflects limited direct damage potential, the ability for any Subscriber-level account to trigger this action increases operational risk and may indicate broader authorization gaps in the plugin codebase.

Affected systems

All versions of the GW AI Website Builder plugin for WordPress up to and including version 1.0.1 are affected. Any WordPress installation running this plugin with at least one Subscriber-level account (which is a default user role on most WordPress sites) is at risk. Multi-user WordPress installations and those with contributor or freelancer accounts face heightened exposure.

Exploitability

Exploitation is straightforward and requires only WordPress authentication at Subscriber level or higher, a common user role. An attacker or compromised low-privilege account can trigger the disconnection via a single AJAX POST request to wp-admin/admin-ajax.php with action=gwaiwebu_gravitywrite_disconnect. No user interaction, complex bypasses, or elevated privileges are needed, making this practical for malicious insiders or users with basic site access.

Remediation

Update the GW AI Website Builder plugin to a patched version that includes capability checks on the gwaiwebu_gravitywrite_disconnect_handler() function. Verify the patched version against the plugin vendor's advisory to confirm the fix. Additionally, audit WordPress user accounts and restrict Subscriber or Contributor roles to trusted users only; consider using capability-limiting plugins to reduce the attack surface from low-privilege accounts.

Patch guidance

Consult the official GW AI Website Builder plugin changelog or vendor advisory for the first patched version after 1.0.1. Update through the WordPress plugin management interface or directly from the vendor's repository. After updating, test GravityWrite integration to confirm functionality is restored. If the plugin lacks an updated version, consider temporarily disabling it until a fix is released and evaluating alternative form-building solutions.

Detection guidance

Monitor WordPress audit logs for repeated 'gwaiwebu_gravitywrite_disconnect' AJAX actions, especially from low-privilege user accounts. Check for sudden GravityWrite disconnection events in plugin logs or integration dashboards. Review user account creation and privilege escalation logs to identify compromised or unauthorized Subscriber accounts. Use WordPress security plugins that track AJAX action invocation to detect anomalous plugin behavior patterns.

Why prioritize this

Although the CVSS score is moderate (4.3), prioritize this vulnerability because it affects all deployed versions, requires only basic authentication to exploit, and can disrupt business-critical integrations. The low barrier to entry and lack of user interaction make it an attractive target for insider threats or accounts compromised through credential stuffing. Organizations running the GW AI Website Builder plugin should patch as soon as a fix is available.

Risk score, explained

CVE-2026-1946 scores 4.3 (MEDIUM) under CVSS 3.1 due to network accessibility (AV:N), low attack complexity (AC:L), and required authentication (PR:L). The impact is limited to integrity (I:L) with no confidentiality or availability loss, reflecting the localized nature of disconnecting a single integration. The score would be higher if the vulnerability allowed code execution or data exfiltration, but the practical risk to organizations depends on how critical GravityWrite integration is to their workflows.

Frequently asked questions