CVE-2026-9615 is a missing authorization vulnerability (CWE-862) in the Flex Import WordPress plugin versions up to and including 3.0. The functions license_activate_fleximp() and license_deactivate_fleximp(), which handle AJAX requests for license activation and deactivation, lack both current_user_can() capability checks and nonce verification despite the client sending a 'wpnonce' value. This flaw enables authenticated attackers with subscriber-level privileges or higher to activate arbitrary or fraudulent license keys or deactivate the site's valid license, thereby affecting the plugin's premium functionality by altering stored license options.

An attacker with at least subscriber-level access can manipulate the plugin's license status without proper authorization. They can activate fraudulent licenses, potentially enabling premium features illegitimately, or deactivate the legitimate license, disrupting premium functionality. There is no direct confidentiality or availability impact reported. The CVSS score is 4.3 (medium severity) reflecting low complexity and limited impact on integrity only.

No official patch or fix is currently documented. Users should monitor the vendor advisory for updates. Until a fix is available, restricting user roles to trusted individuals and limiting subscriber-level access may reduce risk. Because the vulnerability involves missing authorization checks and nonce validation, applying custom code to add these checks could mitigate exploitation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.