CVE-2026-86706: Quick quotes <= 1.0.0 - Unauthenticated Integer-Value Option Update

Q: Who can exploit this issue?

Any unauthenticated remote user can exploit the vulnerable AJAX action. No login, capability, or user interaction is required.

Q: What impact can an attacker have?

An attacker can select an option to write and alter arbitrary WordPress site settings. This can affect site integrity and can make the site unavailable.

Q: Which installations are affected?

Quick quotes versions through 1.0.0 are affected. The issue is in an AJAX action that lacks both capability and nonce checks.

Published Oct 11, 2026

Updated

The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is written, allowing unauthenticated users to alter arbitrary site settings and to make the site unavailable.

Affected Software

1 affected component

Quick quotes<=1.0.0

Event History

Oct 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated remote user can exploit the vulnerable AJAX action. No login, capability, or user interaction is required.

What impact can an attacker have?

An attacker can select an option to write and alter arbitrary WordPress site settings. This can affect site integrity and can make the site unavailable.

Which installations are affected?

Quick quotes versions through 1.0.0 are affected. The issue is in an AJAX action that lacks both capability and nonce checks.

CVE-2026-86706: Quick quotes <= 1.0.0 - Unauthenticated Integer-Value Option Update

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What impact can an attacker have?

Which installations are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What impact can an attacker have?

Which installations are affected?