CVE-2026-85121
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create and overwrite arbitrary WordPress options with request data, which can take the site offline and deactivate all of its Insurify WordPress plugin through 1.0.
Risk Assessment
The risk includes site downtime and plugin deactivation, potentially leading to service disruption and data loss.
Recommendation
Update the Insurify plugin to a patched version and restrict access to AJAX endpoints.
Other vulnerabilities in Insurify WordPress plugin
Original NVD description (English source)
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create and overwrite arbitrary WordPress options with request data, which can take the site offline and deactivate all of its Insurify WordPress plugin through 1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS