CVE-2025-7664: CWE-862 Missing Authorization in loword AL Pack
The AL Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the check_activate_permission() permission callback for the /wp-json/presslearn/v1/activate REST API endpoint in all versions up to, and including, 1.1.1. The callback reads the client-supplied Origin header and, after parsing, allows the request if it matches one of the trusted domains, without ever verifying user authentication, capabilities, or nonce tokens. This makes it possible for unauthenticated attackers to activate premium features by simply spoofing the Origin header.
AI Analysis
Technical Summary
CVE-2025-7664 is a missing authorization vulnerability (CWE-862) in the AL Pack plugin for WordPress. The vulnerability exists in the check_activate_permission() permission callback for the /wp-json/presslearn/v1/activate REST API endpoint, which fails to perform proper user authentication or capability checks. Instead, it only validates the client-supplied Origin header against trusted domains, enabling attackers to bypass authorization controls by spoofing this header. This flaw affects all versions up to and including 1.1.1 of the plugin.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to activate premium features of the AL Pack plugin without proper authorization. This could lead to unauthorized use of premium functionality, potentially impacting the plugin's licensing and business model. There is no indication of confidentiality or availability impact, but the integrity of licensing enforcement is compromised.
Mitigation Recommendations
Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory for updates and apply any official patches once released. Until then, consider restricting access to the affected REST API endpoint or implementing custom authorization checks as a temporary mitigation.
CVE-2025-7664: CWE-862 Missing Authorization in loword AL Pack
Description
The AL Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the check_activate_permission() permission callback for the /wp-json/presslearn/v1/activate REST API endpoint in all versions up to, and including, 1.1.1. The callback reads the client-supplied Origin header and, after parsing, allows the request if it matches one of the trusted domains, without ever verifying user authentication, capabilities, or nonce tokens. This makes it possible for unauthenticated attackers to activate premium features by simply spoofing the Origin header.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-7664 is a missing authorization vulnerability (CWE-862) in the AL Pack plugin for WordPress. The vulnerability exists in the check_activate_permission() permission callback for the /wp-json/presslearn/v1/activate REST API endpoint, which fails to perform proper user authentication or capability checks. Instead, it only validates the client-supplied Origin header against trusted domains, enabling attackers to bypass authorization controls by spoofing this header. This flaw affects all versions up to and including 1.1.1 of the plugin.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to activate premium features of the AL Pack plugin without proper authorization. This could lead to unauthorized use of premium functionality, potentially impacting the plugin's licensing and business model. There is no indication of confidentiality or availability impact, but the integrity of licensing enforcement is compromised.
Mitigation Recommendations
Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory for updates and apply any official patches once released. Until then, consider restricting access to the affected REST API endpoint or implementing custom authorization checks as a temporary mitigation.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-07-14T21:30:46.374Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 689fff64ad5a09ad0074399b
Added to database: 8/16/2025, 3:47:48 AM
Last enriched: 4/9/2026, 5:54:08 PM
Last updated: 5/13/2026, 9:24:31 AM
Views: 106
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.