CVE-2026-107869: WordPress Flexible Subscriptions plugin <= 1.8.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP Desk Flexible Subscriptions flexible-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Subscriptions: from n/a through 1.8.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Desk Flexible Subscriptionsto a version that resolves this vulnerability.Fixed in 1.8.5
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability requires an attacker to have low-privileged access to the affected WordPress site. It is remotely exploitable and does not require user interaction.
What impact can successful exploitation have?
Successful exploitation can affect integrity, meaning an attacker may be able to make unauthorized changes. The supplied severity vector indicates no confidentiality or availability impact.
Which installations are affected?
WP Desk Flexible Subscriptions versions through 1.8.4 are affected. The available information does not state whether a default configuration is vulnerable or identify a fixed version.