All vulnerabilities
CVE-2026-86717

Insurify <= 1.0 - Unauthenticated Arbitrary Option Deletion via removeimg_popup

Unknown Insurify
Open in ThreatlineRecord JSON
CVSS
9.1Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.31%Chance of exploitation activity in the next 30 days, higher than 22% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published11 Oct 2026Updated 11 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role.

Text from CVE List

Affected versions 1

  • Insurifyaffected: all versions through 1.0CVE List

References 1