CVE-2026-86706
9.1 CRITICALPublished 2026-10-11 · Updated 2026-10-13
AI risk analysis
- Summary
- The Quick quotes WordPress plugin has a critical vulnerability that allows unauthenticated users to modify arbitrary site settings through an AJAX endpoint lacking capability and nonce checks. This can lead to complete site compromise and unavailability.
- Exploitability
- Very easy to exploit with no preconditions required, as the vulnerability allows direct modification of any site option without authentication or validation.
- Blast radius
- High impact in real-world scenarios as attackers can completely compromise WordPress settings, potentially leading to full site takeover and service disruption.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Immediate remediation is to upgrade to version 1.0.1 which fixes this capability and nonce check vulnerability.
wp-pluginconfig-modificationunauthenticated
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is written, allowing unauthenticated users to alter arbitrary site settings and to make the site unavailable.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-862
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2026-85121
- HIGHCVE-2026-96818
- HIGHCVE-2026-89299
- HIGHCVE-2026-91136
- HIGHCVE-2026-101923
- HIGHCVE-2026-106029
- HIGHCVE-2026-12000
- HIGHCVE-2026-39796
Related by shared AI tags and CWE weakness class. Browse the full archive.