Insurify WordPress plugin: Missing authorization in AJAX action allows option overwrite
Summary
The Insurify WordPress plugin through version 1.0 does not check authorization and nonces on the AJAX action saveemailtemplatedesign. An unauthenticated attacker can create and overwrite arbitrary WordPress options with request data. This can take the site offline and deactivate plugins. Exploitation requires only network access to the public admin-ajax.php endpoint and that the plugin is active.
Affected
- Insurify WordPress plugin, all versions through 1.0
- Exact affected version range as listed by WPScan: <= 1.0
Fixed in
- Unknown. WPScan lists no known fix.
Workaround
- Deactivate and remove the Insurify plugin until a fixed release is published.
- If the plugin must stay, block unauthenticated requests to the saveemailtemplatedesign action in admin-ajax.php with a WAF or server rule and verify that the rule works.
- Back up the database before any change and check the options table, especially site URL and active plugin settings.
Exploitation
- No confirmed in-the-wild exploitation found; not listed in CISA KEV at the time of research.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- EPSS is low (0.00146 per NVD-based entry).
- Public proof of concept: unknown.
Our recommendation
- Check whether the Insurify plugin is installed on any internet-facing WordPress site. If not, no action is needed.
- If installed, deactivate and remove it, or apply the WAF rule as a temporary measure.
- Review web server logs for unauthenticated requests to admin-ajax.php with the saveemailtemplatedesign action.
- Verify the site URL and active plugin settings in the database and restore from backup if altered.
- Check WordPress.org and the NVD record for a fixed version before reinstalling.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan advisory wpscan.com
- NVD via Vulners vulners.com
- VulDB vuldb.com
- GitHub tracker (KEV/EPSS) github.com
- Mitigation notes (third-party) www.ionix.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:56.
Original description (NVD)
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create and overwrite arbitrary WordPress options with request data, which can take the site offline and deactivate all of its Insurify WordPress plugin through 1.0.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.