CVE-2026-8616 describes a missing authorization vulnerability in the Fense Proxy & VPN Blocker plugin for WordPress. The vulnerable function fense_bpvt_save_settings() is registered to both authenticated and unauthenticated AJAX hooks (wp_ajax_* and wp_ajax_nopriv_*), but it does not perform capability checks or nonce validation. As a result, unauthenticated attackers can invoke this function to delete four plugin options and three transients related to the plugin's API key cache and settings. This unauthorized deletion effectively resets the plugin's cached data and forces it to refetch its state, potentially disrupting normal plugin operation.

The vulnerability allows unauthenticated attackers to delete plugin options and cached data, which could disrupt the plugin's normal operation by forcing it to refetch API keys and settings. There is no direct confidentiality or availability impact reported, but the integrity of plugin settings is compromised. The CVSS score is 5.3 (medium severity) reflecting limited impact on confidentiality and availability but a clear integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, users should consider restricting access to AJAX endpoints or disabling the plugin if possible. Monitor vendor communications for updates and apply any official fixes once released.