CVE-2026-86591: CWE-862 Missing Authorization in Botiga Pro
The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allows unauthenticated users to store arbitrary web scripts which are then executed on every page of the site's front end, as well as to move arbitrary posts to the trash.
AI Analysis
Technical Summary
CVE-2026-86591 describes a missing authorization (CWE-862) vulnerability in the Botiga Pro WordPress plugin prior to version 1.6.5. The vulnerable REST route does not enforce any authorization checks, enabling unauthenticated attackers to modify WordPress options arbitrarily, inject and persist malicious scripts that execute on all front-end pages, and delete posts by moving them to trash. This combination of unauthorized actions can facilitate privilege escalation and complete compromise of the affected WordPress site.
Potential Impact
Unauthenticated attackers can exploit this vulnerability to escalate privileges and gain full control over the WordPress site. They can alter site configuration options, inject persistent malicious scripts that run on every page viewed by visitors, and delete content by trashing posts. This can lead to site defacement, data loss, unauthorized access, and potentially further compromise of the hosting environment.
Mitigation Recommendations
Upgrade the Botiga Pro plugin to version 1.6.5 or later, where this authorization issue has been fixed. No other mitigation is indicated. Patch status is not explicitly stated in the input, but the affected versions are prior to 1.6.5, implying the fix is in 1.6.5.
CVE-2026-86591: CWE-862 Missing Authorization in Botiga Pro
Description
The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allows unauthenticated users to store arbitrary web scripts which are then executed on every page of the site's front end, as well as to move arbitrary posts to the trash.
CVSS v3.1
Score 9.8critical
Affected software
Botiga Pro
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-86591 describes a missing authorization (CWE-862) vulnerability in the Botiga Pro WordPress plugin prior to version 1.6.5. The vulnerable REST route does not enforce any authorization checks, enabling unauthenticated attackers to modify WordPress options arbitrarily, inject and persist malicious scripts that execute on all front-end pages, and delete posts by moving them to trash. This combination of unauthorized actions can facilitate privilege escalation and complete compromise of the affected WordPress site.
Potential Impact
Unauthenticated attackers can exploit this vulnerability to escalate privileges and gain full control over the WordPress site. They can alter site configuration options, inject persistent malicious scripts that run on every page viewed by visitors, and delete content by trashing posts. This can lead to site defacement, data loss, unauthorized access, and potentially further compromise of the hosting environment.
Mitigation Recommendations
Upgrade the Botiga Pro plugin to version 1.6.5 or later, where this authorization issue has been fixed. No other mitigation is indicated. Patch status is not explicitly stated in the input, but the affected versions are prior to 1.6.5, implying the fix is in 1.6.5.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-08T07:34:35.077Z
- State
- PUBLISHED
Threat ID: 6aae2c6755bf5e2cf5363ad7
Added to database: 09/19/2026, 06:32:07 UTC
Last enriched: 09/19/2026, 06:47:10 UTC
Last updated: 09/20/2026, 03:51:51 UTC
Views: 51
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.