Insurify WordPress plugin: Missing authorization allows deletion of WordPress options
Summary
The Insurify WordPress plugin through version 1.0 has an AJAX action without authorization and nonce checks. An unauthenticated attacker can delete arbitrary WordPress options, which can take the site offline and remove the role assignments of all users. No fixed version is known, and the vulnerability is rated critical (CVSS 9.1).
Affected
- Insurify WordPress plugin, all versions through 1.0
- Vendor and developer are not confirmed
Fixed in
Unknown. No fixed version has been identified and WPScan lists the status as No known fix.
Workaround
- Deactivate and remove the plugin until a fix is published (strongest measure)
- Block unauthenticated requests to the plugin's AJAX action via admin-ajax.php at the WAF or web server
- Keep current backups of the WordPress database, including the options table
Exploitation
- No reports of exploitation in the wild found
- Not listed in CISA KEV
- CISA SSVC in the CVE record: Exploitation none, automatable yes, technical impact partial
- One source reports an EPSS score of about 0.15 percent (snapshot)
- Public proof of concept: unverified
Our recommendation
- Check whether the Insurify plugin is installed on any WordPress site, including inactive installs
- If installed, deactivate and remove it now
- If it must remain, apply WAF rules against unauthenticated admin-ajax.php requests as a temporary measure
- Verify that backups are intact and check whether options and user roles are unchanged
- Monitor for a vendor or WordPress.org update and for a confirmed proof of concept
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability entry CVE-2026-86717 wpscan.com
- ionix.io threat center CVE-2026-86717 www.ionix.io
- VulDB CVE-2026-86717 vuldb.com
- OpenCVE CVE-2026-86717 app.opencve.io
- Vulners VulnCheck/CISA enrichment CVE-2026-86717 vulners.com
- GitHub CVE tracking issue CVE-2026-86717 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:58.
Original description (NVD)
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.