Unauthorized Access Vulnerability in AL Pack Plugin for WordPress

CVE-2025-7664

What is CVE-2025-7664?

The AL Pack plugin for WordPress contains a security flaw that allows unauthorized access to its premium features. The issue arises from a missing capability check in the check_activate_permission() callback for the /wp-json/presslearn/v1/activate REST API endpoint. This vulnerability affects all versions up to and including 1.0.2. The callback checks the client-supplied Origin header, but fails to authenticate the user or verify capabilities and nonce tokens. Consequently, unauthenticated attackers can exploit this flaw by spoofing the Origin header, thereby activating premium features without proper authorization.

References