CVE-2026-9615 Overview
The Flex Import plugin for WordPress contains a missing authorization vulnerability affecting all versions up to and including 3.0. The flaw resides in the license_activate_fleximp() and license_deactivate_fleximp() functions, which are hooked to the wp_ajax_license_activate_fleximp and wp_ajax_license_deactivate_fleximp AJAX actions. Both handlers lack a current_user_can() capability check and fail to verify the wpnonce value submitted by the client-side script. Authenticated attackers with subscriber-level access can activate arbitrary license keys or deactivate the site's legitimate license, disrupting the plugin's premium functionality. The issue is tracked as [CWE-862] Missing Authorization.
Critical Impact
Subscriber-level users can toggle premium license state, persist fraudulent keys via update_option('fleximp_is_premium'), or delete legitimate license data by setting fleximp_validation_status to false.
Affected Products
- Flex Import plugin for WordPress, versions up to and including 3.0
- Vulnerable functions: license_activate_fleximp() and license_deactivate_fleximp()
- AJAX endpoints: wp_ajax_license_activate_fleximp and wp_ajax_license_deactivate_fleximp
Discovery Timeline
- 2026-09-19 - CVE-2026-9615 published to NVD
- 2026-09-21 - Last updated in NVD database
Technical Details for CVE-2026-9615
Vulnerability Analysis
The Flex Import plugin exposes two authenticated AJAX endpoints that manage premium license state. Because both endpoints are registered under wp_ajax_* (rather than wp_ajax_nopriv_*), any logged-in user, including subscribers, can invoke them. The handlers perform license state changes without validating either the caller's role or the request's origin.
When license_activate_fleximp() executes, it accepts a license key from the request and persists it. It calls update_option('fleximp_is_premium', ...) and toggles related options controlling validation, suspension, and bundle status. The license_deactivate_fleximp() handler deletes the stored key and sets fleximp_validation_status to false, disabling premium features.
Root Cause
The root cause is the absence of two standard WordPress security controls in privileged AJAX handlers. First, neither function calls current_user_can() to confirm the requesting user has an administrative capability. Second, although the client-side JavaScript sends a wpnonce parameter, the server never validates it with check_ajax_referer() or wp_verify_nonce(). This combination violates WordPress's defense-in-depth model for authenticated actions.
Attack Vector
Exploitation requires an authenticated session with at least subscriber-level access, a privilege tier that is trivially obtainable on any WordPress site permitting user registration. The attacker sends a crafted POST request to /wp-admin/admin-ajax.php specifying action=license_activate_fleximp (or the deactivate variant) along with a license key parameter. Because no capability or nonce verification occurs, the server processes the request and updates plugin options. No user interaction from an administrator is required.
Refer to the Wordfence Vulnerability Analysis and the WordPress Flex Import License Function source for the vulnerable code paths.
Detection Methods for CVE-2026-9615
Indicators of Compromise
- Unexpected POST requests to /wp-admin/admin-ajax.php with action=license_activate_fleximp or action=license_deactivate_fleximp originating from low-privileged user sessions.
- Changes to the fleximp_is_premium, fleximp_validation_status, or bundle status options in the WordPress wp_options table that do not correlate with administrator activity.
- License key values in the options table that do not match keys issued by the plugin vendor.
Detection Strategies
- Monitor WordPress access logs for AJAX requests targeting the two license_*_fleximp actions and correlate them against the requesting user's role.
- Enable audit logging plugins to record update_option and delete_option events for fleximp_* keys.
- Alert on any change to premium licensing options performed by a user without the manage_options capability.
Monitoring Recommendations
- Track subscriber-role account creation on sites running Flex Import, particularly bursts of registrations from a single IP or ASN.
- Baseline normal license activation activity and generate alerts on frequency deviations.
- Forward WordPress and web server logs to a centralized analytics platform for retention and correlation.
How to Mitigate CVE-2026-9615
Immediate Actions Required
- Update the Flex Import plugin to a version later than 3.0 once the vendor releases a patched build addressing the missing authorization checks.
- Audit the wp_options table for unauthorized values in fleximp_is_premium, fleximp_validation_status, and related license options and restore legitimate values.
- Disable open user registration or restrict the default new-user role to prevent untrusted subscriber accounts from being created.
- Review WordPress user accounts and remove any suspicious low-privileged users created recently.
Patch Information
The vendor commit is referenced in the Flex Import changeset 3630901. Administrators should verify their installed plugin version is later than 3.0 and confirm the fix introduces both a current_user_can() capability check and nonce verification in the affected handlers.
Workarounds
- Temporarily deactivate the Flex Import plugin until a fixed version is installed if premium features are not business-critical.
- Use a web application firewall rule to block requests to /wp-admin/admin-ajax.php where the action parameter equals license_activate_fleximp or license_deactivate_fleximp and the session role is below administrator.
- Restrict access to /wp-admin/admin-ajax.php at the network edge to trusted administrator IP ranges where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.