CVE-2026-86591

The Botiga Pro WordPress plugin before 1.6.5 is missing authorization checks on its Templates Builder REST route , allowing unauthenticated users to update arbitrary WordPress options with arbitrary values. This can lead to privilege escalation and a full site takeover . The same route also permi...