{"id":26821,"date":"2026-09-19T16:31:50","date_gmt":"2026-09-19T08:31:50","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-9615"},"modified":"2026-09-19T16:31:50","modified_gmt":"2026-09-19T08:31:50","slug":"cve-2026-9615","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-9615","title":{"rendered":"CVE-2026-9615 [MEDIUM] &#8211; The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all version"},"content":{"rendered":"<p>The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the license_activate_fleximp() and license_deactivate_fleximp() functions, hooked to the wp_ajax_license_activate_fleximp and wp_ajax_license_deactivate_fleximp AJAX actions, lacking both a capability check (current_user_can()) and nonce verification (the client-side script sends a &#8216;wpnonce&#8217; value but the handlers never validate it). This makes it possible for authenticated attackers, with subscriber-level access and above, to activate an arbitrary\/fraudulent license key (persisting it via update_option(&#8216;fleximp_is_premium&#8217;) and toggling validation, suspension, and bundle status options) or deactivate the site&#8217;s legitimate license (deleting the stored key and setting fleximp_validation_status to false), thereby disrupting the plugin&#8217;s premium functionality.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the license_activate_fleximp() and license_deactivate_fleximp() fu<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-26821","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/26821","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=26821"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=26821"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=26821"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}