CVE-2026-9615: Flex Import <= 3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'license_activate_fleximp' and 'license_deactivate_fleximp' AJAX Actions
The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the licenseactivatefleximp() and licensedeactivatefleximp() functions, hooked to the wpajaxlicenseactivatefleximp and wpajaxlicensedeactivatefleximp AJAX actions, lacking both a capability check (currentusercan()) and nonce verification (the client-side script sends a 'wpnonce' value but the handlers never validate it). This makes it possible for authenticated attackers, with subscriber-level access and above, to activate an arbitrary/fraudulent license key (persisting it via updateoption('fleximpispremium') and toggling validation, suspension, and bundle status options) or deactivate the site's legitimate license (deleting the stored key and setting fleximpvalidationstatus to false), thereby disrupting the plugin's premium functionality.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or higher can invoke the affected AJAX actions. No administrator privileges or user interaction are required.
What can an attacker change?
An attacker can activate an arbitrary or fraudulent Flex Import license key, altering the plugin's premium, validation, suspension, and bundle-status options. They can also deactivate the legitimate license by deleting its stored key and setting the validation status to false, disrupting premium functionality.
Are nonce protections sufficient to prevent exploitation?
No. Although the client-side script sends a wpnonce value, the affected handlers do not verify it. They also do not perform a WordPress capability check.
What versions are affected?
All Flex Import versions up to and including 3.0 are affected.