EUVD-2026-96766
GHSA-jx49-gcm7-9vg4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach site admin-ajax endpoint
-
DeliverySend crafted AJAX option-write request
-
ExploitBypass missing capability/nonce check
-
ExecutionOverwrite arbitrary WordPress option
-
ImpactCorrupt settings and disable site
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond having the Quick Quotes plugin (version through 1.0.0) installed and active on a reachable WordPress site: the vulnerable AJAX action performs no capability or nonce check, so a remote unauthenticated attacker can invoke it directly against a default configuration. Exploitation requires no authentication, no user interaction, and no non-default setting. The only meaningful limiting factor is deployment scope - the site must actually run this specific, obscure plugin - not any configuration prerequisite or privilege level. |
| Impact | Signals align toward genuine high risk despite a limited deployment footprint. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction, consistent with the description's statement that an AJAX action performs no capability or nonce check and lets the caller choose which option is written. CWE-862 (Missing Authorization) matches this broken-access-control pattern. Integrity and availability are rated High (C:N/I:H/A:H) because an attacker can overwrite arbitrary WordPress options, which can corrupt configuration and take the site offline; the absence of confidentiality impact is why the score is 9.1 rather than 10.0. A public exploit exists (WPScan), raising practical exploitability, but there is NO CISA KEV listing and NO EPSS score provided, so widespread active exploitation is not confirmed - the elevated risk here comes from triviality of exploitation plus public POC, not from observed in-the-wild campaigns. The dominant limiting factor is reach: this is an obscure plugin at version 1.0.0 with no evident large install base, so the realistic priority is high for any site actually running Quick Quotes but low in aggregate exposure. No EPSS data is available to quantify exploitation probability. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted request to the plugin's unprotected admin-ajax.php action, specifying an arbitrary WordPress option name and value. Because no capability or nonce check is enforced, the chosen option (e.g. siteurl, home, or active template settings) is overwritten, letting the attacker reconfigure or break the site. A public exploit is available via WPScan, making this straightforward to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Unauthenticated remote attackers can rewrite arbitrary WordPress site settings through an AJAX action exposed by the Quick Quotes plugin through version 1.0.0, which performs no capability or nonce validation on the request. Successful abuse allows an attacker to change site-wide options - including those that can render the site unreachable - with no authentication, no user interaction, and no non-default configuration required, yielding an assessed CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). Publicly available exploit code exists per the WPScan disclosure, though the plugin's obscure deployment footprint limits the broader blast radius; there is no indication of confirmed active exploitation (not in CISA KEV) and no vendor-released patch was identified at time of analysis.
RemediationAI
No vendor-released patch was identified at time of analysis, so the primary action is to deactivate and delete the Quick Quotes plugin from every WordPress installation where it is present - an acceptable trade-off for an obscure plugin with a high-severity unauthenticated option-write flaw, and the only measure that fully removes the attack surface. If business requirements genuinely prevent removal, restrict access to /wp-admin/admin-ajax.php so that unauthenticated POST requests carrying the plugin's action parameter are blocked at the WAF or reverse proxy; this is a compensating control only, it requires first enumerating the exact action name from the plugin source, and a blanket block on admin-ajax.php will break legitimate front-end functionality in other plugins, so scope the rule narrowly. Additional monitoring measures: track unexpected changes to wp_options (particularly siteurl, home, active_plugins, users_can_register, default_role, and admin email), alert on admin-ajax.php requests from unauthenticated clients to unknown actions, and maintain recent database backups so a corrupted or unavailable site can be restored quickly. Because publicly available exploit code exists, treat any site still running Quick Quotes 1.0.0 as exposed until the plugin is removed. Consult the WPScan advisory (https://wpscan.com/vulnerability/d160d2a3-acc8-40f5-93ea-65f902f6df5d/) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-86706) for any subsequently published fixed version.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-862 (Missing Authorization). WordPress exposes plugin AJAX handlers through wp-admin/admin-ajax.php, where hooks registered with the wp_ajax_nopriv_ prefix are deliberately reachable by unauthenticated visitors. A secure handler must call check_ajax_referer() (or wp_verify_nonce()) and a capability check such as current_user_can('manage_options') before performing privileged work. The Quick Quotes handler omits both, and additionally lets the caller specify which option key is written, so the missing authorization is compounded by an unconstrained option-write primitive rather than a single fixed setting. Because option writes are not scoped, the impact extends across wp_options - integrity and availability are both rated High (I:H/A:H) while confidentiality is not (C:N), consistent with the assessed vector. The supplied CPE (cpe:2.3:a:unknown:quick_quotes:*:*:*:*:*:*:*:*) reflects that the plugin's vendor namespace is not confidently attributed, and EUVD lists the affected range as Quick quotes versions 0 through 1.0.0; ENISA tracks this as EUVD-2026-96766.
Know when Quick Quotes gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Unauthenticated AJAX action with no nonce/capability check gives AV:N/AC:L/PR:N/UI:N; arbitrary option writes yield I:H and A:H, with no data disclosure so C:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is written, allowing unauthenticated users to alter arbitrary site settings and to make the site unavailable.
Technical POC Analysis
CWE-862 Missing Authorization.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
The Quick Quotes plugin for WordPress, versions up to and including 1.0.0, exposes an unauthenticated AJAX action that allows attackers to rewrite arbitrary site settings, potentially rendering the site unreachable. Organizations running this plugin face immediate availability and integrity risks, as no vendor patch is available and publicly available exploit code exists. Leadership should prioritize identifying and removing the plugin to prevent site outages and reputational damage.
No vendor-released patch identified at time of analysis; interim mitigations include deactivating and removing the Quick Quotes plugin, blocking the vulnerable AJAX action at the WAF, and monitoring site settings for unauthorized changes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB