CVE-2026-86591: Botiga Pro WordPress Privilege Escalation

CVE-2026-86591 Overview

CVE-2026-86591 is a missing authorization vulnerability in the Botiga Pro WordPress plugin versions before 1.6.5. The plugin exposes a REST API route without any authorization checks. Unauthenticated attackers can update arbitrary WordPress options with arbitrary values through this route. The same endpoint permits attackers to store arbitrary web scripts that execute on every front-end page. Attackers can also move arbitrary posts to the trash. Exploitation can lead to privilege escalation and full site takeover.

Critical Impact
Unauthenticated remote attackers can modify site options, inject persistent scripts across the front end, and take over affected WordPress installations.

Affected Products

Botiga Pro WordPress plugin versions prior to 1.6.5
WordPress sites using vulnerable versions of the Botiga Pro theme extension
Any front-end visitor is exposed to injected scripts served by compromised sites

Discovery Timeline

2026-09-19 - CVE-2026-86591 published to the National Vulnerability Database
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-86591

Vulnerability Analysis

The vulnerability stems from a REST API route registered by Botiga Pro that lacks permission callbacks. The route accepts requests from any unauthenticated client and processes them as trusted input. Attackers can invoke the endpoint to write arbitrary values into the WordPress options table. Because WordPress options control critical site behavior, this write primitive translates directly into privilege escalation. An attacker can enable open registration and set the default role to administrator, then create an administrator account. The same endpoint also stores attacker-controlled scripts that render on every front-end page and can trash arbitrary posts. This condition is classified as Missing Authorization [CWE-862].

Root Cause

The plugin registers a REST route without a permission_callback that validates the requesting user. WordPress treats routes without a valid permission callback as publicly accessible. Business logic that writes to wp_options and post state assumes the caller is privileged, but no capability check enforces that assumption.

Attack Vector

An attacker sends unauthenticated HTTP requests to the vulnerable REST endpoint exposed by the plugin. The requests target option names such as users_can_register and default_role to grant administrator privileges to newly registered accounts. Alternate payloads store JavaScript in options rendered on the front end, producing stored cross-site scripting against every visitor. See the WPScan Vulnerability Report for technical details on the affected route.

Detection Methods for CVE-2026-86591

Indicators of Compromise

Unexpected changes to users_can_register, default_role, siteurl, or home values in wp_options
New administrator accounts that were not provisioned by site operators
Unfamiliar <script> tags rendered in the site header, footer, or theme option outputs
Posts moved to the trash without a matching entry in the WordPress activity log

Detection Strategies

Inspect web server access logs for unauthenticated POST requests to Botiga Pro REST routes under /wp-json/
Baseline the wp_options table and alert on modifications to security-sensitive keys
Monitor for creation of administrator users outside of approved change windows

Monitoring Recommendations

Forward WordPress and web server logs to a centralized analytics platform for correlation
Track REST API request rates and source IP addresses targeting plugin endpoints
Alert on stored content changes in theme option fields that render inline scripts

How to Mitigate CVE-2026-86591

Immediate Actions Required

Update the Botiga Pro plugin to version 1.6.5 or later on all WordPress sites
Audit the wp_users and wp_usermeta tables for unauthorized administrator accounts
Review the wp_options table for tampered values and restore known-good settings
Rotate credentials for all administrator accounts after remediation

Patch Information

The vendor addressed the missing authorization issue in Botiga Pro version 1.6.5. The fix adds authorization checks to the affected REST route so unauthenticated callers are rejected. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Block unauthenticated access to Botiga Pro REST routes at a web application firewall until the plugin is upgraded
Disable the Botiga Pro plugin on sites that cannot be patched immediately
Restrict access to /wp-json/ endpoints by IP address where feasible

bash

# Example WAF rule concept to block unauthenticated requests to the vulnerable route
# Adjust the location pattern to match the specific Botiga Pro REST namespace
location ~* ^/wp-json/botiga(-pro)?/ {
    if ($http_cookie !~* "wordpress_logged_in_") {
        return 403;
    }
}