{"id":"CVE-2026-86717","published":"2026-10-11T07:17:26.337","lastModified":"2026-10-13T20:36:00.850","description":"The Insurify  WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/598c7ff4-d6cb-4b4b-a8cd-83f019d10350/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Insurify WordPress plugin lacks proper authorization and nonce checks in its AJAX handler, allowing unauthenticated attackers to delete critical WordPress options that can take sites offline and remove all user roles.","exploitability":"Exploitation is straightforward requiring no authentication or user interaction, with the only precondition being that the vulnerable plugin is installed and active on a WordPress site.","blast_radius":"The impact could be severe across many WordPress sites using the Insurify plugin, potentially causing widespread outages and complete loss of administrative access for all users.","remediation":"Disable the Insurify plugin immediately or upgrade to version 1.1 which includes proper authorization and nonce checks for the affected AJAX action.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["wp-plugin","auth-bypass","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:49:40.191Z"}}