Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-86717

Insurify <= 1.0 - Unauthenticated Arbitrary Option Deletion via removeimg_popup

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV
Public exploit
None on Exploit-DB
CISA SSVC
  • Exploitation: none
  • Automatable: yes
  • Technical impact: partial
?

Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).

SSVC documentation

Summary

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role.

Affected versions

  • Unknown Insurify

    through 1.0

References 1

wpscan.com