---
id: CVE-2026-86706
title: >-
  The Quick quotes  WordPress plugin through 1.0.0 does not perform any
  capability or nonce check on one of its AJAX actions and lets the caller
  choose which option is written, allowing unauthenticated users to alter
  arbitrary site setting…
summary: >-
  The Quick quotes  WordPress plugin through 1.0.0 does not perform any
  capability or nonce check on one of its AJAX actions and lets the caller
  choose which option is written, allowing unauthenticated users to alter
  arbitrary site setting…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'
cwe:
  - CWE-862
published: '2026-10-11'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T12:17:24.510'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86706'
references:
  - url: 'https://wpscan.com/vulnerability/d160d2a3-acc8-40f5-93ea-65f902f6df5d/'
    label: contact@wpscan.com
tags:
  - nvd
ingestedAt: '2026-10-11T08:44:24.721Z'
epss: 0.00146
epssPercentile: 0.03385
---

## Overview

The Quick quotes  WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is written, allowing unauthenticated users to alter arbitrary site settings and to make the site unavailable.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.