Executive brief
The Flex Import plugin for WordPress lacks proper authorization checks in its license management functions, allowing any authenticated user to fraudulently activate or deactivate licenses. An attacker with a basic subscriber account can activate fake license keys to unlock premium features or disable legitimate licenses to disrupt functionality, affecting organizations relying on the plugin's paid features.
Technical details
The license_activate_fleximp() and license_deactivate_fleximp() AJAX handlers lack both capability checks and nonce verification despite the client-side code submitting a wpnonce value. Authenticated users can invoke these handlers via AJAX to inject arbitrary license keys or delete existing ones, modifying plugin options (fleximp_is_premium, fleximp_validation_status) without authorization. The vulnerability requires prior WordPress authentication but no administrative privileges.
Affected products
- Flex Import Flex Import up to and including 3.0
Timeline
- 2026-09-19: disclosed