Flex Import
Monthly
Missing authorization in the Flex Import plugin for WordPress (all versions up to and including 3.0) allows any authenticated user with subscriber-level access or above to invoke the license_activate_fleximp and license_deactivate_fleximp AJAX handlers, which perform neither a current_user_can() capability check nor validation of the 'wpnonce' value the client-side script supplies. A low-privileged attacker can persist an arbitrary or fraudulent license key, flipping the plugin's validation, suspension, and bundle status options, or delete the site's legitimate key and set fleximp_validation_status to false, disrupting the plugin's premium functionality. The impact is confined to license-state manipulation with no data disclosure, privilege escalation, or code execution; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (4.3), and no public exploit identified at time of analysis.
Missing authorization in the Flex Import plugin for WordPress (all versions up to and including 3.0) allows any authenticated user with subscriber-level access or above to invoke the license_activate_fleximp and license_deactivate_fleximp AJAX handlers, which perform neither a current_user_can() capability check nor validation of the 'wpnonce' value the client-side script supplies. A low-privileged attacker can persist an arbitrary or fraudulent license key, flipping the plugin's validation, suspension, and bundle status options, or delete the site's legitimate key and set fleximp_validation_status to false, disrupting the plugin's premium functionality. The impact is confined to license-state manipulation with no data disclosure, privilege escalation, or code execution; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (4.3), and no public exploit identified at time of analysis.