Authorization Bypass in Flex Import Plugin for WordPress

CVE-2026-9615

What is CVE-2026-9615?

The Flex Import plugin for WordPress exposes a vulnerability where authenticated users, even with minimal permissions, can manipulate license states. The absence of essential capability checks and nonce validation in critical functions enables such users to activate fraudulent license keys or deactivate legitimate ones, severely compromising the plugin's functionality and access control.

References