CVE-2026-107869

4.3Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-862

Impact

Authenticated attackers with low privileges can bypass access controls to modify subscription settings or data. They need valid credentials to an account on the target WordPress site.

Root cause

The plugin fails to perform proper authorization checks on sensitive actions, allowing low-privileged users to execute privileged functionality.

Affected systems

WP Desk Flexible Subscriptions through 1.8.4

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Fix & remediation

Upgrade Flexible Subscriptions to a version higher than 1.8.4 once available. If patching must wait, deactivate the flexible-subscriptions plugin.

shell

$ wp plugin update flexible-subscriptions

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Missing Authorization vulnerability in WP Desk Flexible Subscriptions flexible-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Subscriptions: from n/a through 1.8.4.

References

https://patchstack.com/database/wordpress/plugin/flexible-subscriptions/vulnerability/wordpress-flexible-subscriptions-plugin-1-8-4-broken-access-control-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-107869