CVE-2026-86717

Published 11 October 2026 · tracked since 12 October 2026

Description

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role.

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-108753 CRITICAL 9.4
• CVE-2026-96227 HIGH 8.8
• CVE-2026-89232 HIGH 8.6
• CVE-2026-89234 HIGH 8.6
• CVE-2026-89283 HIGH 8.6
• CVE-2026-89285 HIGH 8.6
• CVE-2026-89287 HIGH 8.6
• CVE-2026-89297 HIGH 8.6
• CVE-2026-88826 HIGH 8.8
• CVE-2026-88827 HIGH 8.8

→ Open the live CVE board · all tools