The Colibri Page Builder plugin for WordPress contains a missing authorization vulnerability (CWE-862) in the callActivateLicenseEndpoint function. This flaw permits authenticated users with minimal privileges (subscriber or higher) to update the license key, bypassing intended capability checks. The issue affects all versions up to 1.0.260. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

An attacker with subscriber-level access can modify the license key used by the plugin. While this does not impact confidentiality or availability, it can lead to unauthorized license changes, potentially affecting plugin functionality or licensing enforcement. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access where possible and monitor for unusual license key changes. Avoid granting unnecessary privileges to authenticated users.