CVE-2026-86717 — Insurify <= 1.0 - Unauthenticated Arbitrary Option Deletion via removeimg_popup

CVE-2026-86717

Insurify <= 1.0 - Unauthenticated Arbitrary Option Deletion via removeimg_popup PUBLISHED

Description (CNA)

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role.

Affected (CNA)

Vendor / product	Versions
Unknown / Insurify	affected 0 through 1.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/598c7ff4-d6cb-4b4b-a8cd-83f019d10350/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.