Description

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create and overwrite arbitrary WordPress options with request data, which can take the site offline and deactivate all of its Insurify WordPress plugin through 1.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-10-11T07:17:26.007Z",
  "pubdate": "2026-10-11T07:17:26.007Z",
  "executiveSummary": "The Insurify WordPress plugin through version 1.0 contains a critical security vulnerability involving an improper access control flaw within its AJAX handling mechanisms.\nThis vulnerability allows unauthenticated, remote attackers to perform unauthorized administrative actions by manipulating WordPress configuration options.\nThe flaw stems from the complete absence of authorization checks and nonces (number used once) on a specific AJAX action, effectively exposing site configuration endpoints to the public internet.\nSuccessful exploitation enables an attacker to overwrite arbitrary WordPress options, which can lead to complete site disruption, denial of service, or the deactivation of plugin functionalities.\nGiven that the exploit requires no prior authentication or administrative privileges, the risk profile is considered high, as it grants unauthorized actors control over site-wide settings that govern core WordPress behavior.",
  "technicalDetails": "The vulnerability resides in the Insurify WordPress plugin through version 1.0, specifically within the implementation of its AJAX action handlers. The root cause is a failure to implement mandatory security primitives, namely capability checks (using current_user_can) and anti-CSRF nonce verification within the request lifecycle.\nIn WordPress development, AJAX handlers exposed via the 'wp_ajax_nopriv_' hook are accessible to unauthenticated users. When these handlers fail to validate the legitimacy of a request, the underlying functionality becomes exposed to malicious manipulation. In this specific case, the plugin provides an AJAX action that incorrectly permits the modification of values within the 'wp_options' database table.\nThe attack flow begins with an unauthenticated attacker crafting a POST request directed at the WordPress 'admin-ajax.php' endpoint. By specifying the vulnerable action parameter associated with the Insurify plugin, the attacker triggers the backend logic intended for administrative option management. Since there are no nonce checks to verify the request's origin and no permission checks to verify the requester's role, the server executes the update_option() function using the attacker-supplied payload.\nAn attacker can target critical site options, such as 'siteurl', 'home', or 'active_plugins'. By overwriting these values, an attacker can effectively redirect site traffic, inject malicious settings, or force the deactivation of the Insurify plugin and other critical security components. Because the vulnerability interacts directly with the database 'wp_options' table, the impact is persistent; once the option is overwritten, the changes remain in effect until manually corrected by an administrator.\nThis vulnerability highlights a critical breakdown in secure coding practices within the plugin’s architecture. The lack of input sanitization and validation on the options being updated further compounds the issue, allowing attackers to inject arbitrary data into the site's configuration. The network exposure is total, as any remote actor with access to the public-facing WordPress installation can interact with the vulnerable AJAX endpoint without needing to bypass any authentication barriers, privilege levels, or session management systems."
}