CVE-2025-7664

Al Pack <= 1.1.1 - Missing Authorization to Unauthenticated Premium Feature Activation via check_activate_permission Function

View on CVE.org

Published Aug 16, 2025 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

The AL Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the check_activate_permission() permission callback for the /wp-json/presslearn/v1/activate REST API endpoint in all versions up to, and including, 1.1.1. The callback reads the client-supplied Origin header and, after parsing, allows the request if it matches one of the trusted domains, without ever verifying user authentication, capabilities, or nonce tokens. This makes it possible for unauthenticated attackers to activate premium features by simply spoofing the Origin header.

Analysis

Technical impact

The vulnerability stems from a missing capability check in the check_activate_permission callback for the /wp-json/presslearn/v1/activate REST endpoint. Consequently, any user can send a request that spoofs the Origin header to a trusted domain and the plugin will activate premium features without verifying authentication, capabilities, or nonce tokens. This flaw is a classic example of CWE‑862: Missing Authorization, allowing attackers to gain privileged functionality that should be restricted to authorized users.

Affected Systems

The flaw affects the AL Pack plugin for WordPress, as distributed by loword:AL Pack, in all releases up to and including version 1.1.1.

Risk and Exploitability

With a CVSS score of 7.5 the vulnerability carries moderate severity. The EPSS score of less than 1% indicates a low probability of immediate exploitation, and the issue is not listed in the CISA KEV catalog. The attack vector is straightforward: an unauthenticated client can target the REST endpoint, spoofing the Origin header. Because the check never validates the user identity or permissions, the attacker can activate premium features and potentially gain further access to the plugin’s functionality. The overall risk thus remains moderate but remains actionable.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

loword

AL Pack

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.1.1

No data.

Vendor	Product	Versions
Loword	Al Pack	—
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the AL Pack plugin to the freshest release that corrects the missing authorization check; the fix ensures authentication and capability validation in the check_activate_permission callback.
If an update cannot be performed immediately, restrict access to the /wp-json/presslearn/v1/activate route by configuring the web server (e.g., with .htaccess or firewall rules) to require a valid WordPress session cookie or admin credentials.
Implement a temporary filter or hook in WordPress to enforce a capability check on the REST endpoint, ensuring that only logged‑in users with the appropriate role can invoke the activation function.

Generated by OpenCVE AI on April 21, 2026 at 19:20 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-25064	The AL Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the check_activate_permission() permission callback for the /wp-json/presslearn/v1/activate REST API endpoint in all versions up to, and including, 1.0.2. The callback reads the client-supplied Origin header and, after parsing, allows the request if it matches one of the trusted domains, without ever verifying user authentication, capabilities, or nonce tokens. This makes it possible for unauthenticated attackers to activate premium features by simply spoofing the Origin header.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.536% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/alpack/trunk/includes/api.php
https://plugins.trac.wordpress.org/changeset/3346754/
https://wordpress.org/plugins/alpack/#developers
https://www.wordfence.com/threat-intel/vulnerabilities/id/793a2096-3332-412e-a45a-a7367b1209a3?source=cve

History

Apr 8, 2026 5:45 PM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description	The AL Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the check_activate_permission() permission callback for the /wp-json/presslearn/v1/activate REST API endpoint in all versions up to, and including, 1.0.2. The callback reads the client-supplied Origin header and, after parsing, allows the request if it matches one of the trusted domains, without ever verifying user authentication, capabilities, or nonce tokens. This makes it possible for unauthenticated attackers to activate premium features by simply spoofing the Origin header.	The AL Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the check_activate_permission() permission callback for the /wp-json/presslearn/v1/activate REST API endpoint in all versions up to, and including, 1.1.1. The callback reads the client-supplied Origin header and, after parsing, allows the request if it matches one of the trusted domains, without ever verifying user authentication, capabilities, or nonce tokens. This makes it possible for unauthenticated attackers to activate premium features by simply spoofing the Origin header.
Title	Al Pack <= 1.0.2 - Missing Authorization to Unauthenticated Premium Feature Activation via check_activate_permission Function	Al Pack <= 1.1.1 - Missing Authorization to Unauthenticated Premium Feature Activation via check_activate_permission Function
References		https://plugins.trac.wordpress.org/changeset/3346754/

Aug 18, 2025 9:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Loword Loword al Pack Wordpress Wordpress wordpress
Vendors & Products		Loword Loword al Pack Wordpress Wordpress wordpress

Aug 18, 2025 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 16, 2025 3:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The AL Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the check_activate_permission() permission callback for the /wp-json/presslearn/v1/activate REST API endpoint in all versions up to, and including, 1.0.2. The callback reads the client-supplied Origin header and, after parsing, allows the request if it matches one of the trusted domains, without ever verifying user authentication, capabilities, or nonce tokens. This makes it possible for unauthenticated attackers to activate premium features by simply spoofing the Origin header.
Title		Al Pack <= 1.0.2 - Missing Authorization to Unauthenticated Premium Feature Activation via check_activate_permission Function
Weaknesses		CWE-862
References		https://plugins.trac.wordpress.org/browser/alpack/trunk/includes/api.php https://wordpress.org/plugins/alpack/#developers https://www.wordfence.com/threat-intel/vulnerabilities/id/793a2096-3332-412e-a45a-a7367b1209a3?source=cve
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}`