EUVD-2026-83576
GHSA-47cg-2qj2-mr6r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain subscriber-level account (self-register)
-
DeliveryCraft POST to admin-ajax.php license action
-
ExploitHandler skips capability and nonce checks
-
Executionupdate_option/delete stored license key
-
ImpactDisrupt or spoof plugin premium licensing state
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account with subscriber-level access or above on a WordPress site running Flex Import plugin version <=3.0 (PR:L). The vulnerable wp_ajax_license_activate_fleximp / wp_ajax_license_deactivate_fleximp AJAX actions are registered for any authenticated user and validate neither capability (current_user_can) nor the nonce the client-side script sends, so exploitation works against default configurations with no user interaction. Limiting factors: an attacker must first gain a low-privilege account (open registration must be enabled or credentials otherwise obtained), and impact is confined to the plugin's premium-license options (no data disclosure, RCE, or site takeover). |
| Impact | This is a low-priority issue despite being remotely reachable. The CVSS 3.1 base score is 4.3 (vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), reflecting low-privilege authenticated access (PR:L, subscriber-level) and a single limited integrity impact (I:L) with no confidentiality or availability effect. There is no EPSS score provided, the CVE is NOT in CISA KEV, and no public exploit code is referenced - so this is 'no public exploit identified at time of analysis.' No SSVC decision data is supplied. The real-world impact is narrow: an attacker can only corrupt the plugin's premium-licensing state (spoof a fraudulent license or disable the legitimate one), not read data, execute code, or take over the site. Signals are consistent (low CVSS, no KEV, no POC, integrity-only) - this is a genuine low-real-risk flaw, not a high-CVSS-but-low-risk mismatch. One data-quality caveat: the input Tags label this 'Authentication Bypass,' which conflicts with the CWE-862 (Missing Authorization) classification and the PR:L authenticated vector - this is an authorization/missing-authz flaw against already-authenticated low-privilege users, not an authentication bypass. |
| Exploit ScenarioDerived | An attacker who has (or self-registers for) a subscriber-level account on a WordPress site running Flex Import <=3.0 sends a crafted POST to admin-ajax.php invoking wp_ajax_license_deactivate_fleximp; because the handler checks neither capability nor nonce, the site's legitimate premium license key is deleted and validation status set to false, breaking premium functionality. Alternatively the attacker calls wp_ajax_license_activate_fleximp to persist a fraudulent license. No public exploit code is identified, but the attack is trivial (AC:L) once authenticated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 19, 2026
Missing authorization in the Flex Import plugin for WordPress (all versions up to and including 3.0) allows any authenticated user with subscriber-level access or above to invoke the license_activate_fleximp and license_deactivate_fleximp AJAX handlers, which perform neither a current_user_can() capability check nor validation of the 'wpnonce' value the client-side script supplies. A low-privileged attacker can persist an arbitrary or fraudulent license key, flipping the plugin's validation, suspension, and bundle status options, or delete the site's legitimate key and set fleximp_validation_status to false, disrupting the plugin's premium functionality. The impact is confined to license-state manipulation with no data disclosure, privilege escalation, or code execution; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (4.3), and no public exploit identified at time of analysis.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed. The vendor has committed a fix in the WordPress.org plugin repository as changeset 3630901 for the flex-import plugin (https://plugins.trac.wordpress.org/changeset?reponame=&old=3630901%40flex-import&new=3630901%40flex-import), which adds the missing authorization and nonce checks to the license_activate_fleximp and license_deactivate_fleximp handlers; because no tagged release version above 3.0 is confirmed in the available data, verify the installed plugin version against the vendor/advisory page https://www.wordfence.com/threat-intel/vulnerabilities/id/0143b789-06ea-47da-9736-3266f91a9e33?source=cve before assuming you are patched. If an updated build is not yet available or cannot be deployed, the most reliable compensating control is to deactivate and remove the Flex Import plugin entirely - this eliminates the vulnerable AJAX actions, at the cost of losing its import functionality. If the plugin must remain active, harden the account surface: disable open user registration and audit existing accounts so that no untrusted subscriber-level users exist, since the handlers authorize any authenticated user (side effect: legitimate low-privilege contributors are also constrained). A WAF or reverse-proxy rule that rejects POST requests to /wp-admin/admin-ajax.php with action=license_activate_fleximp or action=license_deactivate_fleximp from authenticated low-privilege sessions provides interim protection but must be scoped narrowly, as broadly blocking admin-ajax.php breaks other plugins, and IP- or role-based rules do not address the underlying missing capability check. As a manual code fix, add current_user_can('manage_options') and check_ajax_referer()/wp_verify_nonce() validation at the top of both handler functions and re-verify the stored license afterwards; note that custom edits will be overwritten by the next plugin update and should be folded back into the upstream release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Flex Import is a commercial WordPress plugin whose licensing logic lives in includes/fleximp-license-functions.php and is exposed through WordPress's AJAX API. The wp_ajax_license_activate_fleximp and wp_ajax_license_deactivate_fleximp hooks are registered for any authenticated user regardless of role, so the handlers are reachable by a subscriber. The root cause is CWE-862 (Missing Authorization): the functions omit both a current_user_can() capability gate and a check_ajax_referer()/wp_verify_nonce() call, even though the accompanying JavaScript transmits a 'wpnonce' field - the server simply ignores it. Because the handlers write directly to plugin options (update_option('fleximp_is_premium') plus validation, suspension, and bundle status flags, and deletion of the stored key), the missing check translates into unauthorized state modification rather than data exposure. The same pattern is visible across tagged source branches referenced in the advisory (tags 2.5 and 2.8, lines ~86, 93, 159, 161), indicating the flaw is longstanding rather than a regression in a single release. CPE cpe:2.3:a:flextheme:flex_import:*:*:*:*:*:*:*:* confirms the vendor/product mapping as flextheme:flex_import.
Know when Flex Import gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Remotely reachable AJAX action needs a low-privilege authenticated account (PR:L) and is trivial (AC:L); impact limited to modifying license-state options, so I:L, C:N, A:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the license_activate_fleximp() and license_deactivate_fleximp() functions, hooked to the wp_ajax_license_activate_fleximp and wp_ajax_license_deactivate_fleximp AJAX actions, lacking both a capability check (current_user_can()) and nonce verification (the client-side script sends a 'wpnonce' value but the handlers never validate it). This makes it possible for authenticated attackers, with subscriber-level access and above, to activate an arbitrary/fraudulent license key (persisting it via update_option('fleximp_is_premium') and toggling validation, suspension, and bundle status options) or deactivate the site's legitimate license (deleting the stored key and setting fleximp_validation_status to false), thereby disrupting the plugin's premium functionality.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB