WordPress Botiga Pro plugin < 1.6.5 - Unauthenticated Arbitrary Blog Options Update vulnerability

Unauthenticated Arbitrary Blog Options Update vulnerability discovered by Erwan LR WPScan in WordPress Plugin Botiga Pro versions 1.6.5...

CVE-2026-86591

The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allo...

EUVD-2026-83505

The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allo...

CVE-2026-86591

The Botiga Pro WordPress plugin (versions before 1.6.5 ) is vulnerable to an unauthenticated arbitrary blog options update via a flaw in the Templates Builder REST route . Due to a lack of authorization checks, unauthenticated attackers can update arbitrary WordPress options with arbitrary values...

CVE-2026-86591 Botiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder REST Route

The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allo...

CVE-2026-86591 Botiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder REST Route

The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allo...

CVE-2026-86591: Missing Authorization

The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allo...

PT-2026-95758

Name of the Vulnerable Software and Affected Versions Botiga Pro versions prior to 1.6.5 Description Lack of authorization checks on a REST route allows unauthenticated users to update arbitrary WordPress options with arbitrary values. This can lead to privilege escalation and full site takeover...