CVE-2026-9615

Overview

The Flex Import plugin for WordPress up to version 3.0 suffers from a missing authorization vulnerability in its AJAX license management functions. Attackers with low-level subscriber access can fraudulently activate or deactivate plugin license keys. This allows unauthorized modification of premium feature states and can disrupt business operations.

Description

The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the license_activate_fleximp() and license_deactivate_fleximp() functions, hooked to the wp_ajax_license_activate_fleximp and wp_ajax_license_deactivate_fleximp AJAX actions, lacking both a capability check (current_user_can()) and nonce verification (the client-side script sends a 'wpnonce' value but the handlers never validate it). This makes it possible for authenticated attackers, with subscriber-level access and above, to activate an arbitrary/fraudulent license key (persisting it via update_option('fleximp_is_premium') and toggling validation, suspension, and bundle status options) or deactivate the site's legitimate license (deleting the stored key and setting fleximp_validation_status to false), thereby disrupting the plugin's premium functionality.

Impact

Authenticated low-level users (subscribers and above) can modify plugin licensing options, leading to unauthorized activation of fraudulent licenses or the deactivation of legitimate ones. This integrity violation directly impacts the confidentiality and availability of the plugin's premium features for the organization. The attack vector is strictly limited to authenticated users within the WordPress application.

Remediation

Update the Flex Import plugin to version 3.0.1 or higher, or the latest patched version provided by the vendor. Ensure that proper capability checks (such as current_user_can()) and strict nonce verification are implemented in all AJAX action handlers. Regularly audit WordPress user roles to minimize accounts with subscriber-level access where appropriate.

Risk context

The vulnerability holds a medium severity rating with a CVSS base score of 4.3 and an EPSS score of 0.0025, indicating a low current probability of exploitation in the wild. However, remediation is recommended to prevent unauthorized administrative actions on plugin functionality.

Affected products

• Flex Import plugin for WordPress