The vulnerability stems from a missing capability check in the check_activate_permission callback for the /wp-json/presslearn/v1/activate REST endpoint. Consequently, any user can send a request that spoofs the Origin header to a trusted domain and the plugin will activate premium features without verifying authentication, capabilities, or nonce tokens. This flaw is a classic example of CWE‑862: Missing Authorization, allowing attackers to gain privileged functionality that should be restricted to authorized users.

The flaw affects the AL Pack plugin for WordPress, as distributed by loword:AL Pack, in all releases up to and including version 1.1.1.

With a CVSS score of 7.5 the vulnerability carries moderate severity. The EPSS score of less than 1% indicates a low probability of immediate exploitation, and the issue is not listed in the CISA KEV catalog. The attack vector is straightforward: an unauthenticated client can target the REST endpoint, spoofing the Origin header. Because the check never validates the user identity or permissions, the attacker can activate premium features and potentially gain further access to the plugin’s functionality. The overall risk thus remains moderate but remains actionable.