CVE-2026-86717

Summary

The Insurify WordPress plugin lacks proper authorization and nonce checks in its AJAX handler, allowing unauthenticated attackers to delete critical WordPress options that can take sites offline and remove all user roles.

Exploitability

Exploitation is straightforward requiring no authentication or user interaction, with the only precondition being that the vulnerable plugin is installed and active on a WordPress site.

Blast radius

The impact could be severe across many WordPress sites using the Insurify plugin, potentially causing widespread outages and complete loss of administrative access for all users.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the Insurify plugin immediately or upgrade to version 1.1 which includes proper authorization and nonce checks for the affected AJAX action.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.