EUVD-2026-96764
GHSA-v69x-x643-f98h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted unauthenticated AJAX request
-
ExploitOverwrite arbitrary WordPress options
-
ImpactCorrupt config and take site offline
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default installations of the Insurify WordPress plugin (versions through 1.0); any site exposing the vulnerable AJAX action is affected out of the box. The only prerequisite is that the plugin is installed and active, since the vulnerable AJAX endpoint performs neither an authorization capability check nor a nonce (CSRF) check. Limiting factors are minimal: no authentication, no privileged role, and no user interaction are required, so the primary real-world constraint is simply the plugin's limited deployment footprint, not any technical barrier. |
| Impact | Signals are largely consistent toward high priority but with one notable gap. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges or user interaction, and CWE-862 (Missing Authorization) matches the description's claim that an AJAX action lacks both authorization and nonce checks. Impact is scored C:N/I:H/A:H - no data disclosure, but attacker-controlled overwrite of arbitrary WordPress options (integrity) that can take the site offline (availability), which is coherent with the 9.1 Critical score. A public exploit exists (WPScan), raising practical exploitability, but this is POC availability, not confirmed active exploitation - the input shows no CISA KEV listing. No EPSS score was provided, so statistical exploitation probability cannot be weighed. No SSVC decision data was supplied. Net: the technical barrier to exploitation is genuinely low and exploit code is public, so this is a real priority for any site running the plugin; however, real-world risk is bounded by the plugin's apparent niche deployment rather than by any technical mitigation. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted request to the plugin's unprotected AJAX action, overwriting arbitrary WordPress options (for example core settings that control site availability or active plugins). Because no authentication, nonce, or user interaction is required, a single automated HTTP request can corrupt site configuration and take the site offline. A public proof-of-concept is referenced by WPScan, lowering the effort to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Unauthenticated remote attackers can overwrite arbitrary WordPress options on any site running the Insurify plugin through version 1.0, because one of the plugin's AJAX actions performs neither a capability (authorization) check nor a nonce/CSRF check - a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) reflects high integrity and availability impact with no privileges or user interaction required. Exploitation can rewrite site-critical options, take the site offline, and deactivate the plugin itself, and publicly available exploit code exists (per the WPScan report and its exploit-tagged reference); there is no indication of confirmed active exploitation (not listed in CISA KEV). The practical constraint is the plugin's limited deployment footprint, not any technical barrier.
RemediationAI
No vendor-released patch identified at time of analysis, so the primary remediation is to deactivate and uninstall the Insurify plugin (all versions through 1.0) and monitor the WPScan advisory at https://wpscan.com/vulnerability/74955313-6f62-4e7c-9b7c-0ab345657377/ for a patched release; the trade-off is the loss of the plugin's functionality. If the plugin cannot be removed immediately, block unauthenticated POST requests to /wp-admin/admin-ajax.php that carry the plugin's AJAX action parameter, enforced at the WAF or reverse proxy - this is a compensating control that fails open if the parameter is obfuscated or the filtering layer is bypassed, and it does not help sites that expose admin-ajax.php without any filtering. Additional mitigations with their side effects: restrict /wp-admin/admin-ajax.php by IP allow-list where the plugin's AJAX functionality is not needed by anonymous users (side effect: breaks legitimate front-end AJAX for other plugins and themes); and immediately inspect the wp_options table for unauthorized changes to active_plugins, siteurl, home, and template keys, since these are the values an attacker is most likely to overwrite for takedown or deactivation, and restore clean values from backup if tampering is found. Because publicly available exploit code exists, treat any site running the plugin as exposed until it is removed and check web server logs for unauthenticated POSTs to admin-ajax.php with unexpected action values.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-862 (Missing Authorization): the plugin registers an AJAX handler that is reachable without authentication (wp_ajax_nopriv_-style registration) and, per the WPScan report, performs no current_user_can() capability check and no check_ajax_referer()/wp_verify_nonce() validation before passing request data into WordPress option-writing functionality such as update_option()/add_option(). This 'option injection' allows an attacker to define or overwrite arbitrary option keys and values in the wp_options table. Because many WordPress core and plugin behaviours are driven by options, an attacker can set or corrupt values such as active_plugins (deactivating the Insurify plugin and potentially other plugins), siteurl/home (breaking redirects and the front end), and other configuration keys, resulting in site defacement or a persistent denial of service. The supplied CPE (cpe:2.3:a:unknown:insurify:*:*:*:*:*:*:*:*) uses a wildcard version with an unresolved vendor component, and EUVD lists the affected range as Insurify 0 through 1.0, i.e. every released version of the plugin. WordPress's admin-ajax.php endpoint is a standard, publicly reachable entry point on virtually every WordPress installation, so no unusual deployment configuration is required to reach the vulnerable action.
Know when Insurify gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Missing auth/nonce on a network AJAX action gives AV:N/AC:L/PR:N/UI:N; arbitrary option overwrite is I:H and causes site outage A:H, with no disclosure so C:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create and overwrite arbitrary WordPress options with request data, which can take the site offline and deactivate all of its Insurify WordPress plugin through 1.0.
Technical POC Analysis
Bug class: CWE-862 - Missing Authorization.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
The Insurify WordPress plugin (versions through 1.0) contains a critical unauthenticated flaw that allows remote attackers to overwrite site-critical options, potentially taking affected sites offline and disabling the plugin itself. Organizations running this plugin on customer-facing or internal WordPress sites should treat affected deployments as high business risk until removed or mitigated, especially because publicly available exploit code exists and no vendor patch has been identified. Leadership should prioritize an inventory and remediation decision for any site using Insurify, given the integrity and availability impact and the low technical barrier to abuse.
No vendor-released patch identified at time of analysis. Interim mitigations: remove or deactivate Insurify plugin versions through 1.0; if removal is not immediately possible, block unauthenticated requests to the plugin's AJAX action endpoints through WAF or reverse proxy rules, restrict access to wp-admin/admin-ajax.php where feasible, and monitor for unauthorized option changes, site outages, or plugin deactivation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB