An unauthorized AJAX endpoint named removeimg_popup in the Insurify WordPress plugin allows a visitor without any authentication or nonce verification to delete arbitrary WordPress options stored on the site. By removing critical options, an attacker can bring the site down and erase all user roles, effectively removing administrative access. The flaw corresponds to improper access control and missing authorization for an operation that alters site configuration.

Vulnerabilities affect the Insurify WordPress plugin versions 1.0 and earlier. WordPress sites that have installed this plugin before version 1.0 are potentially impacted. No other vendors or products are listed, so every installation of the vulnerable Insurify plugin must be examined.

The flaw carries a CVSS score of 9.1, indicating a high severity and potential for loss of availability and confidentiality. The EPSS score is under 1%, implying a low probability of widespread exploitation, yet the vulnerability is not currently listed in CISA KEV. The attack vector is purely unauthenticated and requires only that the site is running a vulnerable Insurify plugin, making exploitation straightforward for an attacker seeking to take the site offline or remove administrative control.