Unauthenticated AJAX Action Allows WordPress Option Manipulation

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create and overwrite arbitrary WordPress options with request data, which can take the site offline and deactivate all of its Insurify WordPress plugin through 1.0.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Insurify WordPress plugin through version 1.0 contains a critical authorization vulnerability (CWE-862) in its AJAX actions that completely removes authentication and nonce verification requirements. This flaw allows unauthenticated attackers to create or overwrite arbitrary WordPress options through direct HTTP requests, potentially rendering websites completely offline by modifying core configuration settings or deactivating the plugin itself. Any WordPress site running the affected Insurify plugin is vulnerable without user interaction required—making this particularly dangerous in the wild, especially for organizations relying on WordPress for critical business functions or customer-facing services.

Casky's 283 mapped skills detect the attack patterns underlying this vulnerability across MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky's Claude AI-powered analysis would identify multiple red flags: unauthorized AJAX endpoint calls lacking nonce tokens, privilege escalation attempts moving from unauthenticated to administrative capabilities, and suspicious wp_options table modifications from external sources. The platform's extended reasoning would surface that attackers exploit improper access controls (TA0004) to bypass authentication entirely, then leverage credential/option access (TA0006) to obtain sensitive configuration data or admin settings. Security teams would see findings highlighting missing capability checks (current_user_can() calls), absent wp_verify_nonce() validations, and direct option manipulation without proper authorization layers—enabling faster remediation of similar patterns across their plugin ecosystem.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-85121.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-85121

Casky has 283 skills that investigate the attack patterns behind CVE-2026-85121. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn