Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-86591 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allows unauthenticated users to store arbitrary web scripts which are then executed on every page of the site's front end, as well as to move arbitrary posts to the trash.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:9.1 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CNA: CISA-ADPCVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://wpscan.com/vulnerability/e2389a60-16c2-4750-b85e-a82b91390b30/	[email protected]	AdvisoryExploitRemedy

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-862	Missing Authorization	CISA-ADP

Affected Products

Product	Versions
Botiga Pro	< 1.6.5 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 1.6.5moderate effort

Change History

2 change records found show changes

Date	Action	Recorded By
Sep 19, 2026	CVE Modified	CISA-ADP
Sep 19, 2026	New CVE Received	[email protected]