{"vulnerability": "cve-2026-86591", "sightings": [{"uuid": "8fb6200d-f0d0-49c8-b8f6-42f195f61e62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-86591", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117297238793242186", "content": "CVE-2026-86591 | CRITICAL | Botiga Pro <1.6.5 allows unauthenticated attackers to modify WP options, inject persistent XSS, and trash posts due to missing REST API authorization. Immediate upgrade to 1.6.5+ is essential. https://radar.offseq.com/threat/cve-2026-86591-cwe-862-missing-authorization-in-botiga-pro-dcf5d6244d090e38 #OffSeq #WordPress #CVE202686591", "creation_timestamp": "2026-09-19T10:30:25.973171Z"}, {"uuid": "9dc6d184-0a8c-4221-b349-39b551c5a64a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-86591", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mvui2oyj7t25", "content": "Botiga Pro <1.6.5 has a CRITICAL flaw: missing REST API auth lets attackers hijack WP sites \u2014 inject scripts, trash posts, escalate privileges. Update to 1.6.5+ ASAP. https://radar.offseq.com/threat/cve-2026-86591-cwe-862-missing-authorization-in-botiga-pro-dcf5d6244d090e38 #OffSeq #WordPress #Vuln", "creation_timestamp": "2026-09-19T10:30:27.358978Z"}, {"uuid": "f1b68317-fbca-4e7c-86fa-9059ae7538d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86591", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvut7osk7v2y", "content": "CVE-2026-86591 - botiga pro\nThe Botiga Pro add\u2011on for WordPress allows people who are not logged in to use a special web address to modify the site\u2019s configuration, add malicious code that runs on every\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#botigapro #unknown #CVE #infosec", "creation_timestamp": "2026-09-19T13:50:05.833103Z"}, {"uuid": "1ddbccf6-7ab5-4d46-96f9-7d9fe89e0814", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86591", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvuxczrag724", "content": "\ud83d\udd34 CVE-2026-86591 - Critical (9.8)\n\nThe Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-86591/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-19T15:03:33.639362Z"}]}