CVE-2026-9615

Name of the Vulnerable Software and Affected Versions Flex Import versions prior to 3.1

Description The plugin contains a missing authorization flaw. The license activate fleximp() and license deactivate fleximp() functions, which are linked to the wp ajax license activate fleximp and wp ajax license deactivate fleximp AJAX actions, do not perform capability checks using current user can() or validate nonces. This allows authenticated users with subscriber-level access or higher to activate fraudulent license keys by modifying fleximp is premium via update option() or deactivate legitimate licenses by setting fleximp validation status to false, which disrupts premium features.

Recommendations Update to a version later than 3.0.