EUVD-2026-96767
GHSA-4xmx-25jq-qc2p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend unauthenticated AJAX request
-
ExploitInvoke unprotected delete-options action (no nonce)
-
ExecutionDelete arbitrary WordPress options
-
ImpactSite taken offline and all user roles stripped
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond having the Insurify WordPress plugin (version ≤1.0) installed and active - the vulnerable AJAX action lacks both authorization (capability) and nonce checks, so remote unauthenticated exploitation works against default configurations. The only meaningful limiting factor is deployment: the target site must run this specific, low-footprint plugin. There is no authentication, user-interaction, or non-default-setting requirement that would otherwise constrain exploitation. |
| Impact | This is a genuine high-priority issue rather than an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, fully unauthenticated attack with no user interaction, and the impact is split as C:N/I:H/A:H - no data disclosure, but attacker-controlled destruction of WordPress options that can take the site offline (A:H) and strip every user of their role (I:H), consistent with CWE-862 (Missing Authorization). POC/exploit code is publicly available (reported by WPScan), which lowers the barrier to opportunistic abuse, though POC availability is NOT the same as active exploitation. No EPSS score was supplied, so statistical exploitation probability cannot be stated. KEV status is absent/NO, so there is no evidence of confirmed in-the-wild exploitation at this time. No SSVC decision data was provided. The signals are internally consistent (network, unauthenticated, destructive, public exploit) with no contradictions; the main limiting factor on real-world impact is the apparently small deployment footprint of the plugin rather than any technical difficulty. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted AJAX request to the vulnerable action on a site running the Insurify plugin (≤1.0), which lacks both authorization and nonce checks. Because a public exploit exists (WPScan), the attacker can delete arbitrary WordPress options - knocking the site offline and demoting all users - with a single HTTP request and no credentials or user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Unauthenticated remote attackers can delete arbitrary WordPress options in sites running the Insurify WordPress plugin through version 1.0, due to missing authorization and nonce checks on an AJAX action, potentially taking the site offline and stripping every user of their role. Publicly available exploit code exists, and the vulnerability is remotely exploitable with no authentication required (CVSS 9.1). Any site with the vulnerable plugin active is at risk.
RemediationAI
No vendor-released patch has been identified at time of analysis. The most effective remediation is to disable and remove the Insurify WordPress plugin until a fix is available. If the plugin cannot be removed immediately, restrict access to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) using a web application firewall (WAF) to block requests containing the vulnerable action parameter, but this may break legitimate plugin functionality. Alternatively, implement a virtual patch by adding capability checks and nonce verification for the affected AJAX action via a custom plugin. Monitor the WPScan advisory at https://wpscan.com/vulnerability/598c7ff4-d6cb-4b4b-a8cd-83f019d10350/ for updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Insurify WordPress plugin registers an AJAX action without implementing capability checks or nonce verification, as classified by CWE-862 (Missing Authorization). In WordPress, AJAX actions are typically handled via admin-ajax.php, which is accessible to unauthenticated users by default. Without a permission callback, any visitor can trigger the action. The missing nonce check also removes protection against cross-site request forgery (CSRF). Successful exploitation allows deletion of arbitrary rows from the wp_options table, which stores critical site configuration; this can cause the site to become unusable and can remove all user roles. The CPE string cpe:2.3:a:unknown:insurify:*:*:*:*:*:*:*:* indicates that all versions of the plugin are potentially affected, though the vendor has confirmed vulnerability through version 1.0.
Know when Insurify gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
AJAX endpoint is network-reachable with no auth or nonce (AV:N/AC:L/PR:N/UI:N); arbitrary option deletion yields high integrity and availability impact but no disclosure (C:N).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role.
Technical POC Analysis
CWE-862 Missing Authorization.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
The Insurify WordPress plugin (versions up to 1.0) contains a critical vulnerability that allows remote attackers to delete arbitrary site options and strip all users of their roles, potentially taking websites offline and locking out administrators. Publicly available exploit code exists, making it easy for attackers to target any organization using this plugin. Leadership should act quickly to mitigate because a successful attack can cause significant operational disruption, data loss, and damage to customer trust.
No vendor-released patch identified at time of analysis. Disable or remove the Insurify WordPress plugin (version 1.0 and earlier) until a vendor patch is released. Implement virtual patching via WAF to block exploitation of the vulnerable AJAX action. Monitor for unauthorized changes to WordPress options and user roles, and maintain offline backups for rapid recovery.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB