Insurify Plugin Allows Unauthenticated WordPress Option Deletion

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Insurify WordPress plugin through version 1.0 contains a critical authorization bypass vulnerability in its AJAX handlers. By failing to implement proper authentication checks and nonce validation, the plugin allows unauthenticated attackers to invoke sensitive AJAX actions that can arbitrarily delete WordPress options. This capability is particularly dangerous because WordPress options control fundamental site configurations, user roles, and permissions. Attackers exploiting this vulnerability can render a WordPress site completely unavailable, strip administrative privileges from all users, and create a complete loss of access control. Any WordPress installation running the vulnerable Insurify plugin is at immediate risk, regardless of other security measures in place.

Casky's 283 mapped skills detect the attack patterns associated with this vulnerability by analyzing the MITRE ATT&CK techniques involved: TA0004 (Privilege Escalation) and TA0006 (Credential Access). Security practitioners using Casky's Claude-powered extended reasoning engine would observe detection signatures for unauthenticated AJAX endpoint access, missing nonce tokens in requests, and suspicious WordPress option deletion patterns. The platform's skill mapping identifies the exploitation chain where attackers craft requests to vulnerable AJAX actions without valid user sessions, correlating this with post-exploitation indicators like mass permission changes and user role modifications. Practitioners would see findings highlighting the absence of authorization middleware on AJAX handlers and flag the CWE-862 (Missing Authorization) weakness, enabling them to prioritize patch deployment and audit their WordPress installations for similar authorization gaps across other installed plugins.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-86717.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-86717

Casky has 283 skills that investigate the attack patterns behind CVE-2026-86717. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn