CVE-2026-9615

The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the license_activate_fleximp() and license_deactivate_fleximp() functions, hooked to the wp_ajax_license_activate_fleximp and wp_ajax_license_deactivate_fleximp AJAX actions, lacking both a capability check (current_user_can()) and nonce verification (the client-side script sends a 'wpnonce' value but the handlers never validate it). This makes it possible for authenticated attackers, with subscriber-level access and above, to activate an arbitrary/fraudulent license key (persisting it via update_option('fleximp_is_premium') and toggling validation, suspension, and bundle status options) or deactivate the site's legitimate license (deleting the stored key and setting fleximp_validation_status to false), thereby disrupting the plugin's premium functionality.

• CWE-862

• https://plugins.trac.wordpress.org/browser/flex-import/tags/2.5/includes/fleximp-license-functions.php#L159
• https://plugins.trac.wordpress.org/browser/flex-import/tags/2.5/includes/fleximp-license-functions.php#L161
• https://plugins.trac.wordpress.org/browser/flex-import/tags/2.5/includes/fleximp-license-functions.php#L86
• https://plugins.trac.wordpress.org/browser/flex-import/tags/2.5/includes/fleximp-license-functions.php#L93
• https://plugins.trac.wordpress.org/browser/flex-import/tags/2.8/includes/fleximp-license-functions.php#L159
• https://plugins.trac.wordpress.org/browser/flex-import/tags/2.8/includes/fleximp-license-functions.php#L161
• https://plugins.trac.wordpress.org/browser/flex-import/tags/2.8/includes/fleximp-license-functions.php#L86
• https://plugins.trac.wordpress.org/browser/flex-import/tags/2.8/includes/fleximp-license-functions.php#L93
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3630901%40flex-import&new=3630901%40flex-import
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0143b789-06ea-47da-9736-3266f91a9e33?source=cve

Published

Sep 19, 2026

Last Modified

Sep 21, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-96134Uncontrolled resource consumption in Windows DHCP Server all…7.5
• CVE-2026-96137Exposure of sensitive system information to an unauthorized …5.5
• CVE-2026-96139Untrusted pointer dereference in Windows Kernel-Mode Drivers…7
• CVE-2026-9614An Improper Access Control vulnerability in Ivanti Neurons f…8.8
• CVE-2026-96144Use of uninitialized resource in Windows Graphics Kernel all…4.7
• CVE-2026-96146IBM SevOne Network Performance Management 7.0.0 through 8.2.…7.5
• CVE-2026-96150Use of uninitialized resource in Microsoft Windows Codecs Li…5.6
• CVE-2026-96152Stack-based buffer overflow in Windows Installer allows an a…7.8
• CVE-2026-96153Heap-based buffer overflow in Windows Error Reporting allows…7
• CVE-2026-96155Use after free in Windows Audio Service allows an authorized…7
• CVE-2026-96156Use of uninitialized resource in Windows Broker Infrastructu…5.5
• CVE-2026-96157Heap-based buffer overflow in Microsoft Windows Media Founda…9.8