CVE-2026-9615 in Flex Import Plugin
Summary
by MITRE • 09/19/2026
The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the license_activate_fleximp() and license_deactivate_fleximp() functions, hooked to the wp_ajax_license_activate_fleximp and wp_ajax_license_deactivate_fleximp AJAX actions, lacking both a capability check (current_user_can()) and nonce verification (the client-side script sends a 'wpnonce' value but the handlers never validate it). This makes it possible for authenticated attackers, with subscriber-level access and above, to activate an arbitrary/fraudulent license key (persisting it via update_option('fleximp_is_premium') and toggling validation, suspension, and bundle status options) or deactivate the site's legitimate license (deleting the stored key and setting fleximp_validation_status to false), thereby disrupting the plugin's premium functionality.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/19/2026
The Flex Import plugin for WordPress contains a critical access control vulnerability affecting all versions up to and including 3.0, classified under CWE-862 as Missing Authorization. This flaw stems from insufficient validation of user permissions within two specific AJAX handlers: license_activate_fleximp() and license_deactivate_fleximp(). These functions are registered to respond to the wp_ajax_license_activate_fleximp and wp_ajax_license_deactivate_fleximp actions, respectively. The core technical deficiency lies in the absence of both a capability check using current_user_can() and proper nonce verification. Although the client-side scripts transmit a wpnonce value intended for security validation, the server-side handlers completely ignore this input, failing to verify that the request originates from an authorized source or user session.
This architectural oversight allows authenticated attackers with subscriber-level access and above to manipulate the plugin's licensing mechanism without restriction. By exploiting these endpoints, an attacker can activate a fraudulent license key, which results in the persistence of premium features through the update_option function setting fleximp_is_premium to true. Simultaneously, the attacker gains the ability to toggle validation states, suspension statuses, and bundle options associated with the plugin's commercial functionality. This unauthorized activation effectively bypasses the intended paywall or licensing enforcement mechanisms built into the software.
The operational impact of this vulnerability extends beyond mere feature unlocking; it includes the potential for service disruption through license deactivation. An attacker can exploit the same endpoints to deactivate a legitimate site owner's license, which involves deleting the stored key and setting fleximp_validation_status to false. This action renders premium features unavailable to the rightful administrator, causing operational downtime or forcing reliance on limited free-tier functionality during critical workflows. Such actions compromise the integrity of the application's business logic and can lead to significant financial loss for plugin vendors who rely on these licensing checks for revenue generation.
From a threat modeling perspective, this vulnerability aligns with MITRE ATT&CK technique T1078, specifically Valid Accounts, as it leverages legitimate but low-privileged credentials to perform administrative-like actions regarding software licensing. The lack of nonce verification also indicates weaknesses in CSRF protection mechanisms, although the primary impact here is driven by missing authorization checks rather than cross-site request forgery alone. To mitigate this risk, developers must implement strict capability checks ensuring that only users with administrator-level privileges can interact with license management endpoints. Additionally, integrating robust nonce validation using wp_verify_nonce() for all AJAX requests is essential to prevent unauthorized state changes. Regular security audits focusing on access control logic in WordPress plugins are recommended to identify and remediate similar authorization flaws before they can be exploited in production environments.