The Checkimate WordPress plugin through version 1.0.13 suffers from improper access control (CWE-284) in its license-management functionality. The plugin uses a shared secret for access control that is computed solely from publicly available information, which is insufficient to prevent unauthorized access. As a result, unauthenticated attackers can exploit this weakness to deactivate the premium license and remove the stored license key, potentially disrupting premium features dependent on licensing.

An attacker without authentication can deactivate the premium license of the Checkimate plugin and erase the stored license key. This may cause loss of premium functionality or service disruption for users relying on the licensed features. There is no indication of further impact such as code execution or data leakage beyond license state manipulation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Users should monitor the vendor's updates for a security patch addressing this improper access control issue. Until a fix is released, restricting access to the plugin's license management endpoints via other means (e.g., web application firewall rules or IP restrictions) may help mitigate risk.