The AL Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the check_activate_permission() permission callback for the /wp-json/presslearn/v1/activate REST API endpoint in all versions up to, and including, 1.0.2. This vulnerability allows unauthenticated attackers to activate premium features by simply spoofing the Origin header, as the request is allowed if it matches one of the trusted domains without verifying user authentication or capabilities.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2025-7664 |
Exploitation
To exploit this vulnerability, an attacker can send a request to the vulnerable REST API endpoint while spoofing the Origin header to match one of the trusted domains. Since there is no authentication or capability checks in place, the attacker can activate premium features without any valid credentials.
Affected Products
- AL Pack Plugin for WordPress: All versions up to and including 1.0.2 are affected by this vulnerability, allowing unauthorized access to premium features.
Mitigation
To mitigate this vulnerability, it is recommended to update the AL Pack plugin to the latest version where the capability checks have been implemented. Additionally, implementing proper authentication and capability checks for REST API endpoints can help prevent unauthorized access.