Description

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-10-11T07:17:26.337Z",
  "pubdate": "2026-10-11T07:17:26.337Z",
  "executiveSummary": "The Insurify WordPress plugin, in versions 1.0 and below, contains a critical security vulnerability involving an unauthenticated AJAX action that lacks necessary authorization checks and nonce verification.\nThis vulnerability allows any remote, unauthenticated attacker to delete arbitrary options from the wp_options database table.\nBy manipulating specific database entries, an attacker can induce a complete site outage or perform privilege escalation by stripping administrative roles from existing accounts.\nThe vulnerability represents a high risk to availability and administrative integrity, as it provides a vector for full site compromise without requiring prior authentication or user interaction.\nThe flaw stems from a failure to implement WordPress security nonces and capability checks within the plugin's AJAX handler architecture.",
  "technicalDetails": "The root cause of this vulnerability is the implementation of an insecure AJAX handler within the Insurify plugin. The plugin registers a callback function for an AJAX action that performs database delete operations using the WordPress update_option or delete_option API without verifying the requester's identity or authorization levels.\nSpecifically, the plugin fails to implement the 'wp_verify_nonce' function, which is the standard WordPress mechanism for preventing Cross-Site Request Forgery (CSRF). Furthermore, the code lacks a 'current_user_can()' check, which is required to ensure that only administrators or users with appropriate permissions can modify system configurations.\nThe attack flow begins with the attacker identifying the specific AJAX action registered by the plugin. Since the endpoint is accessible to unauthenticated users, the attacker can send a crafted HTTP POST request to the 'wp-admin/admin-ajax.php' endpoint. The request payload includes the vulnerable action hook as the 'action' parameter and includes parameters targeting sensitive WordPress options stored in the wp_options table.\nBy targeting core options such as 'siteurl', 'home', or user-role settings, an attacker can effectively trigger a denial-of-service (DoS) condition. For example, deleting the 'user_roles' option or modifying it causes the WordPress role management system to fail, stripping all users—including administrators—of their assigned capabilities. This renders the dashboard inaccessible to legitimate users, effectively locking the site owner out of the administration panel.\nBecause this operation occurs via a server-side AJAX call, the changes are committed directly to the database. The impact is persistent and often requires manual database restoration via SQL tools (e.g., phpMyAdmin or WP-CLI) to revert the deleted or modified options. The lack of input sanitization and privilege validation at the endpoint allows for arbitrary database manipulation, making this a critical security flaw in the plugin's design."
}