VulnSocial

CVE-2026-86591Patch

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allows unauthenticated users to store arbitrary web scripts which are then executed on every page of the site's front end, as well as to move arbitrary posts to the trash.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-20: 1Patch / Workaround · 2026-09-20: 1Technical Details · 2026-09-20: 109-20
Signal classification1 categories
Patch
1100.0%
Referenced assets2 URLs
By indicator
Full discourse1 post
  • ADK Cyber@ADKCyber
    Patch

    CVE-2026-86591 (CVSS 9.8): Botiga Pro WP plugin <1.6.5 allows unauth updates to site options. Update immediately if used. https://nvd.nist.gov/vuln/detail/CVE-2026-86591 https://adkcyber.com via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/8ah3ZTXSAK

    Post summary

    Botiga Pro WP plugin <1.6.5 has a critical unauthenticated site option update vulnerability (CVSS 9.8); users are urged to update immediately.

    0000039
    97 followersView on X

Explore more

Back to dashboard