https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 20:21:02 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-9615 <p>The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the license_activate_fleximp() and license_deactivate_fleximp() functions, hooked to the wp_ajax_license_activate_fleximp and wp_ajax_license_deactivate_fleximp AJAX actions, lacking both a capability check (current_user_can()) and nonce verification (the client-side script sends a &#39;wpnonce&#39; value but the handlers never validate it). This makes it possible for authenticated attackers, with subscriber-level access and above, to activate an arbitrary/fraudulent license key (persisting it via update_option(&#39;fleximp_is_premium&#39;) and toggling validation, suspension, and bundle status options) or deactivate the site&#39;s legitimate license (deleting the stored key and setting fleximp_validation_status to false), thereby disrupting the plugin&#39;s premium functionality.</p> <p>The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the license_activate_fleximp() and license_deactivate_fleximp() functions, hooked to the wp_ajax_license_activate_fleximp and wp_ajax_license_deactivate_fleximp AJAX actions, lacking both a capability check (current_user_can()) and nonce verification (the client-side script sends a &#39;wpnonce&#39; value but the handlers never validate it). This makes it possible for authenticated attackers, with subscriber-level access and above, to activate an arbitrary/fraudulent license key (persisting it via update_option(&#39;fleximp_is_premium&#39;) and toggling validation, suspension, and bundle status options) or deactivate the site&#39;s legitimate license (deleting the stored key and setting fleximp_validation_status to false), thereby disrupting the plugin&#39;s premium functionality.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-9615 https://vulnerability.circl.lu/vuln/ghsa-47cg-2qj2-mr6r <p>The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the license_activate_fleximp() and license_deactivate_fleximp() functions, hooked to the wp_ajax_license_activate_fleximp and wp_ajax_license_deactivate_fleximp AJAX actions, lacking both a capability check (current_user_can()) and nonce verification (the client-side script sends a &#39;wpnonce&#39; value but the handlers never validate it). This makes it possible for authenticated attackers, with subscriber-level access and above, to activate an arbitrary/fraudulent license key (persisting it via update_option(&#39;fleximp_is_premium&#39;) and toggling validation, suspension, and bundle status options) or deactivate the site&#39;s legitimate license (deleting the stored key and setting fleximp_validation_status to false), thereby disrupting the plugin&#39;s premium functionality.</p> <p>The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the license_activate_fleximp() and license_deactivate_fleximp() functions, hooked to the wp_ajax_license_activate_fleximp and wp_ajax_license_deactivate_fleximp AJAX actions, lacking both a capability check (current_user_can()) and nonce verification (the client-side script sends a &#39;wpnonce&#39; value but the handlers never validate it). This makes it possible for authenticated attackers, with subscriber-level access and above, to activate an arbitrary/fraudulent license key (persisting it via update_option(&#39;fleximp_is_premium&#39;) and toggling validation, suspension, and bundle status options) or deactivate the site&#39;s legitimate license (deleting the stored key and setting fleximp_validation_status to false), thereby disrupting the plugin&#39;s premium functionality.</p> https://vulnerability.circl.lu/vuln/ghsa-47cg-2qj2-mr6r