{"vulnerability": "CVE-2026-86717", "sightings": [{"uuid": "efaebc50-bfae-419b-a93a-cf2e9ab5ea9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86717", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117420933300890478", "content": "CVE-2026-86717 Insurify <= 1.0 - Unauthenticated Arbitrary Option Deletion via removeimg_popup The Insurify  WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role.\nhttps://www.cve.org/CVERecord?id=CVE-2026-86717https://wpscan.com/vulnerability/598c7ff4-d6cb-4b4b-a8cd-83f019d10350/#CVE_2026_86717#bot", "creation_timestamp": "2026-10-11T06:47:33.276788Z"}, {"uuid": "e0485595-602c-4775-bccd-5c2fc1a43b0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-86717", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117422163577113012", "content": "CVE-2026-86717 (CRITICAL) targets Insurify WP plugin \u22641.0. Missing auth & nonce checks in AJAX lets unauth users delete WordPress options \u2014 site can be taken offline, user roles wiped. Disable or restrict plugin. https://radar.offseq.com/threat/cve-2026-86717-cwe-862-missing-authorization-in-insurify-d0d6b23b34928b39 #OffSeq #WordPress #CVE202686717 #infosec", "creation_timestamp": "2026-10-11T12:00:26.122058Z"}, {"uuid": "b07282db-88fd-4e04-92d3-e8ab82a412d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-86717", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mxlxdvpfjz2p", "content": "Insurify WordPress plugin \u22641.0 has a CRITICAL vuln (CVE-2026-86717): missing auth checks let attackers delete WP options, locking out all users. Disable plugin or block AJAX endpoints until fixed. https://radar.offseq.com/threat/cve-2026-86717-cwe-862-missing-authorization-in-insurify-d0d6b23b349...", "creation_timestamp": "2026-10-11T12:00:28.481793Z"}, {"uuid": "aac4f9bb-8f89-4392-a343-180576c962cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86717", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxm2olk3im2o", "content": "CVE-2026-86717 - insurify\nThe Insurify WordPress plugin (versions up to 1.0) allows anyone on the internet to trigger a request that removes important site settings. This can shut the website down and strip\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#insurify #unknown #CVE #infosec", "creation_timestamp": "2026-10-11T13:00:06.984872Z"}]}