Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-86706

Quick quotes <= 1.0.0 - Unauthenticated Integer-Value Option Update

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV
Public exploit
None on Exploit-DB
CISA SSVC
  • Exploitation: none
  • Automatable: yes
  • Technical impact: partial
?

Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).

SSVC documentation

Summary

The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is written, allowing unauthenticated users to alter arbitrary site settings and to make the site unavailable.

Affected versions

  • Unknown Quick quotes

    through 1.0.0

References 1

wpscan.com