CVE-2026-86706: CWE-862 Missing Authorization in Quick quotes
Description
The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is written, allowing unauthenticated users to alter arbitrary site settings and to make the site unavailable.
CVSS v3.1
Score 9.1critical
Affected software
Quick quotes
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-86706 is a missing authorization vulnerability (CWE-862) in the Quick quotes WordPress plugin versions up to and including 1.0.0. The plugin fails to perform any capability or nonce verification on an AJAX action, enabling unauthenticated attackers to select which option is written. This can lead to unauthorized modification of site settings and potentially render the site unavailable.
Potential Impact
Unauthenticated attackers can alter arbitrary site settings via the vulnerable AJAX action, which may result in site misconfiguration or denial of service by making the site unavailable.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin's AJAX endpoints if possible or disable the plugin to prevent exploitation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-08T10:52:51.980Z
- State
- PUBLISHED
Threat ID: 6acb2de32cdf04f656b78d08
Added to database: 10/11/2026, 06:34:11 UTC
Last enriched: 10/11/2026, 07:03:31 UTC
Last updated: 10/11/2026, 21:33:31 UTC
Views: 21
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.