CVE-2026-9615

The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the license_activate_fleximp() and license_deactivate_fleximp() functions, hooked to the wp_ajax_license_activate_fleximp and wp_ajax_license_deactivate_fleximp AJAX actions, lacking both a capability check (current_user_can()) and nonce verification (the client-side script sends a 'wpnonce' value but the handlers never validate it). This makes it possible for authenticated attackers, with subscriber-level access and above, to activate an arbitrary/fraudulent license key (persisting it via update_option('fleximp_is_premium') and toggling validation, suspension, and bundle status options) or deactivate the site's legitimate license (deleting the stored key and setting fleximp_validation_status to false), thereby disrupting the plugin's premium functionality.

• CWE-862

• https://plugins.trac.wordpress.org/browser/flex-import/tags/2.5/includes/fleximp-license-functions.php#L159
• https://plugins.trac.wordpress.org/browser/flex-import/tags/2.5/includes/fleximp-license-functions.php#L161
• https://plugins.trac.wordpress.org/browser/flex-import/tags/2.5/includes/fleximp-license-functions.php#L86
• https://plugins.trac.wordpress.org/browser/flex-import/tags/2.5/includes/fleximp-license-functions.php#L93
• https://plugins.trac.wordpress.org/browser/flex-import/tags/2.8/includes/fleximp-license-functions.php#L159
• https://plugins.trac.wordpress.org/browser/flex-import/tags/2.8/includes/fleximp-license-functions.php#L161
• https://plugins.trac.wordpress.org/browser/flex-import/tags/2.8/includes/fleximp-license-functions.php#L86
• https://plugins.trac.wordpress.org/browser/flex-import/tags/2.8/includes/fleximp-license-functions.php#L93
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3630901%40flex-import&new=3630901%40flex-import
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0143b789-06ea-47da-9736-3266f91a9e33?source=cve

Published

Sep 19, 2026

Last Modified

Sep 21, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9609A vulnerability was identified in QianFox FoxCMS up to 1.2.6…4.7
• CVE-2026-9610IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigato…5.3
• CVE-2026-9611Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-9612The WhatsOrder – Instant Checkout for WooCommerce plugin for…5.3
• CVE-2026-9613The Datalogics Ecommerce Delivery – Datalogics plugin for Wo…4.3
• CVE-2026-9614An Improper Access Control vulnerability in Ivanti Neurons f…8.8
• CVE-2026-9616The Generate Security.txt plugin for WordPress is vulnerable…4.3
• CVE-2026-9617PostgreSQL Anonymizer contains a vulnerability that allows a…8.8
• CVE-2026-9618The PeachPay — Payments & Express Checkout for WooCommerce (…4.3
• CVE-2026-9619The Reviews and Rating – Docplanner plugin for WordPress is …4.3
• CVE-2026-9620The WP Latest Posts plugin for WordPress is vulnerable to St…6.4
• CVE-2026-9621A denial-of-service security issue exists within RSLinx® Cla…9.2