{"id":"CVE-2026-86706","published":"2026-10-11T07:17:26.220","lastModified":"2026-10-13T20:36:00.850","description":"The Quick quotes  WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is written, allowing unauthenticated users to alter arbitrary site settings and to make the site unavailable.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/d160d2a3-acc8-40f5-93ea-65f902f6df5d/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Quick quotes WordPress plugin has a critical vulnerability that allows unauthenticated users to modify arbitrary site settings through an AJAX endpoint lacking capability and nonce checks. This can lead to complete site compromise and unavailability.","exploitability":"Very easy to exploit with no preconditions required, as the vulnerability allows direct modification of any site option without authentication or validation.","blast_radius":"High impact in real-world scenarios as attackers can completely compromise WordPress settings, potentially leading to full site takeover and service disruption.","remediation":"Immediate remediation is to upgrade to version 1.0.1 which fixes this capability and nonce check vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["wp-plugin","config-modification","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:49:35.174Z"}}