CVE-2026-8616

Name of the Vulnerable Software and Affected Versions Fense Proxy & VPN Blocker versions prior to 3.0.2

Description Unauthorized modification of data is possible due to a missing capability check and missing nonce validation in the fense bpvt save settings() function. The callback is registered to both wp ajax * and wp ajax nopriv * hooks and unconditionally calls delete option() on four plugin options and delete transient() on three transients related to the plugin's API key cache and settings. This allows unauthenticated attackers to delete plugin options and transients, resetting the API key and data cache, which forces the plugin to refetch state.

Recommendations Update to a version newer than 3.0.1. As a temporary mitigation, restrict access to the fense bpvt save settings() function.