CVE-2026-107869: Missing Authorization in WP Desk Flexible Subscriptions

This vulnerability in WP Desk Flexible Subscriptions (versions >=0 and <1.8.5) is due to missing authorization checks, allowing users with some privileges to perform actions they should not be authorized to do. The CVSS 3.1 base score is 4.3, reflecting network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality or availability impact, but integrity impact is present. No known exploits or vendor patches are reported in the provided data.

The vulnerability allows an attacker with some level of privileges to bypass access control restrictions, potentially modifying subscription-related data without proper authorization. There is no impact on confidentiality or availability, but integrity of the subscription data can be compromised. No evidence of active exploitation is known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user privileges to the minimum necessary and monitor for unusual subscription modifications.