CVE-2026-86591: Botiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder REST Route
The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allows unauthenticated users to store arbitrary web scripts which are then executed on every page of the site's front end, as well as to move arbitrary posts to the trash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin Botiga Proto a version that resolves this vulnerability.Fixed in 1.6.5 - Operational
After upgrading Botiga Pro, review and revert any WordPress options and posts that may have been modified via the unauthenticated REST route, and remove any malicious web scripts that may have been stored and executed on the front end.
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated users can exploit the affected REST route; no login or authorization is required.
What impact could successful exploitation have?
An attacker can update arbitrary WordPress options, potentially escalating privileges and taking over the site. They can also save scripts that execute on every front-end page and move arbitrary posts to the trash.
Which installations are affected?
Botiga Pro versions earlier than 1.6.5 are affected.