Description

The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the license_activate_fleximp() and license_deactivate_fleximp() functions, hooked to the wp_ajax_license_activate_fleximp and wp_ajax_license_deactivate_fleximp AJAX actions, lacking both a capability check (current_user_can()) and nonce verification (the client-side script sends a 'wpnonce' value but the handlers never validate it). This makes it possible for authenticated attackers, with subscriber-level access and above, to activate an arbitrary/fraudulent license key (persisting it via update_option('fleximp_is_premium') and toggling validation, suspension, and bundle status options) or deactivate the site's legitimate license (deleting the stored key and setting fleximp_validation_status to false), thereby disrupting the plugin's premium functionality.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-19T08:16:55.193Z",
  "pubdate": "2026-09-19T08:16:55.193Z",
  "executiveSummary": "The Flex Import plugin for WordPress is affected by a critical Missing Authorization vulnerability, classified under CWE-862. This flaw exists in all versions up to and including 3.0. The vulnerability resides within the license management AJAX handlers, which fail to perform mandatory capability checks or nonce validation.\nThis security deficiency allows authenticated users with subscriber-level access or higher to interact with sensitive license management functions. An attacker can manipulate the plugin's licensing state, effectively activating fraudulent license keys or deactivating legitimate ones. This results in the unauthorized modification of plugin options, including 'fleximp_is_premium', 'fleximp_validation_status', and associated bundle configurations.\nThe impact includes the disruption of premium services and the potential for unauthorized privilege escalation regarding plugin features. Because the affected AJAX hooks are accessible to standard authenticated users, the attack surface is broad for any WordPress site with open user registration or compromised low-privileged accounts. No specific external exploit requirements beyond subscriber-level authentication are necessary to trigger the vulnerable code paths.",
  "technicalDetails": "The vulnerability originates from the improper implementation of AJAX handlers in the Flex Import plugin, specifically within the license_activate_fleximp() and license_deactivate_fleximp() functions. These functions are registered via the wp_ajax_license_activate_fleximp and wp_ajax_license_deactivate_fleximp actions, which are intended to handle license lifecycle management.\nThe root cause is a complete lack of authorization controls. Specifically, the functions fail to invoke current_user_can() to verify if the requesting user possesses the administrative privileges required to modify site-wide plugin configurations. Furthermore, although the plugin's front-end logic transmits a 'wpnonce' parameter, the server-side handlers fail to perform a verify_nonce() check. This omission renders the nonce implementation ineffective, failing to protect against Cross-Site Request Forgery (CSRF) or unauthorized direct requests.\nAn attacker can exploit this flaw by sending a crafted HTTP POST request to the WordPress admin-ajax.php endpoint. By specifying the 'action' parameter as either 'license_activate_fleximp' or 'license_deactivate_fleximp', the attacker forces the server to execute the corresponding function in the context of the current session.\nThe attack flow proceeds as follows: 1) The attacker authenticates as a subscriber. 2) The attacker crafts a request targeting the vulnerable AJAX action. 3) The server, lacking authorization logic, processes the request regardless of the user's role. 4) The handler invokes update_option() calls that overwrite the plugin's internal state. In the case of activation, an attacker can set 'fleximp_is_premium' to true, potentially granting access to restricted features. In the case of deactivation, the attacker can delete stored license keys and set 'fleximp_validation_status' to false, effectively causing a Denial of Service (DoS) for the plugin's premium functionality.\nThe attack is persistent, as the affected functions write directly to the WordPress options table. Consequently, the changes in the plugin's operational state persist across sessions and page reloads. This vulnerability exposes a significant security oversight where administrative-level operations are exposed to low-privileged users via the AJAX API."
}