What is GHSA-4xmx-25jq-qc2p?

GHSA-4xmx-25jq-qc2p is a security advisory published by GitHub Security Advisories with Critical severity. The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of...

Which CVE IDs does GHSA-4xmx-25jq-qc2p cover?

GHSA-4xmx-25jq-qc2p covers the following CVE IDs: CVE-2026-86717. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4xmx-25jq-qc2p?

GHSA-4xmx-25jq-qc2p has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

GHSA-4xmx-25jq-qc2pCriticalCVSS 9.1

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of...

Vendor

GitHub Security Advisories

Published

October 11, 2026

Last Modified

October 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-86717 →

📋 Description

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-86717
https://wpscan.com/vulnerability/598c7ff4-d6cb-4b4b-a8cd-83f019d10350
https://github.com/advisories/GHSA-4xmx-25jq-qc2p