CVE-2026-86717
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role.
Risk Assessment
The risk includes complete site downtime and loss of control over user roles, potentially leading to service disruption and system integrity compromise.
Recommendation
Immediately update the Insurify plugin to a patched version and restrict access to AJAX endpoints.
Other vulnerabilities in Insurify WordPress plugin
Original NVD description (English source)
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS