CVE-2026-107869

MediumCVSS 4.3

Published: 12/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

The Flexible Subscriptions plugin for WordPress up to version 1.8.4 contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects the flexible-subscriptions function.

Risk Assessment

An attacker may gain access to administrative functions without proper permissions, potentially leading to unauthorized changes in subscriptions or user data.

Recommendation

It is recommended to update the Flexible Subscriptions plugin to the latest version that fixes the missing authorization issue.

Other vulnerabilities in Flexible Subscriptions

CVE-2026-73364Critical
PHP Object Injection vulnerability in Flexible Subscriptions plugin versions up to and including 1.8.1. Allows an attacker to inject malicious PHP objects, potentially leading to unauthorized access or code execution.

Original NVD description (English source)

Missing Authorization vulnerability in WP Desk Flexible Subscriptions flexible-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Subscriptions: from n/a through 1.8.4.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS