The Fense Proxy & VPN Blocker plugin for WordPress has a flaw that permits unauthenticated users to delete key configuration options and cached transients through the fense_bpvt_save_settings AJAX action because the routine forgets to verify user capabilities and lacks nonce protection. Removing these stored values forces the plugin to discard its API key and reset its state, which can interrupt the VPN and proxy blocking functionality that the site depends on. This deficiency is classified as CWE‑862 (Missing Authorization), signaling a moderate risk of service disruption rather than a direct privilege escalation or code execution.

WordPress sites running the devozon Fense Proxy & VPN Blocker plugin from version 2.x up through 3.0.1 are susceptible. The vulnerability resides in the plugin’s settings module, where the fense_bpvt_save_settings hook processes both authenticated and unauthenticated AJAX requests, making any visitor capable of triggering option deletion if the endpoint is reachable.

The CVSS score of 5.3 places the issue in the moderate severity band, while an EPSS score of less than 1% indicates that exploit attempts are currently predicted to be rare. Because the AJAX endpoint is publicly accessible, an attacker can execute the deletion simply by issuing a crafted request from the web, even without logging in. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting that no widespread attacks have been documented yet.