Al Pack <= 1.1.1 - Missing Authorization to Unauthenticated Premium Feature Activation via check_activate_permission Function
highThe AL Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the check_activate_permission() permission callback for the /wp-json/presslearn/v1/activate REST API endpoint in all versions up to, and including, 1.1.1. The callback reads the client-supplied Origin header and,...
- CVSS:
- 7.5
- Affected:
- up to 1.1.1
- Fixed in:
- 1.1.2
- Disclosed:
- Aug 15, 2025