Authorization Bypass in Botiga Pro WordPress Plugin
CVE-2026-86591

Currently unrated

Key Information:

Vendor

WordPress
Status
Botiga Pro
Vendor
CVE Published:
19 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-86591?

The Botiga Pro plugin for WordPress prior to version 1.6.5 contains a serious flaw that permits unauthorized users to bypass authorization checks on certain REST routes. This vulnerability enables these users to alter WordPress options with arbitrary values, potentially leading to privilege escalation and full control over the site. Additionally, the exploit allows attackers to store malicious web scripts that are executed on the front end of the site, as well as to manipulate post statuses, such as moving them to the trash. Website owners should ensure that their plugin is updated to the latest version to safeguard against these risks.

Affected Version(s)

Botiga Pro 0 < 1.6.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-86591 - Proof of Concept

References

https://wpscan.com/vulnerability/e2389a60-16c2-4750-b85e-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Erwan LR (WPScan)
WPScan
.