{"id":86811,"date":"2026-03-30T06:57:24","date_gmt":"2026-03-30T06:57:24","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T00:00:00","slug":"cve-2025-7664-unauthorized-access-vulnerability-in-al-pack-plugin-for-wordpress","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-7664-unauthorized-access-vulnerability-in-al-pack-plugin-for-wordpress\/","title":{"rendered":"CVE-2025-7664: Unauthorized Access Vulnerability in AL Pack Plugin for WordPress<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

CVE-2025-7664 is a serious security vulnerability that affects the AL Pack plugin for WordPress. The flaw, which allows unauthenticated users to gain unauthorized access and activate premium features, could potentially lead to system compromise or data leakage. The widespread use of WordPress makes this vulnerability particularly problematic, warranting immediate attention and action.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-7664
\nSeverity: High – 7.5 (CVSS Score)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: System compromise or data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

AL Pack for WordPress | All versions up to, and including, 1.0.2<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The vulnerability stems from a missing capability check on the check_activate_permission() permission callback for the \/wp-json\/presslearn\/v1\/activate REST API endpoint in the AL Pack plugin for WordPress. The callback reads the client-supplied Origin header and, after parsing, allows the request if it matches one of the trusted domains, without ever verifying user authentication, capabilities, or nonce tokens. As a result, unauthenticated attackers can activate premium features by simply spoofing the Origin header.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Here’s a conceptual HTTP request that could potentially exploit this vulnerability:<\/p>\n

POST \/wp-json\/presslearn\/v1\/activate HTTP\/1.1\nHost: target.example.com\nOrigin: trusted.example.com\nContent-Type: application\/json\n{ \"premium_features\": \"activate\" }<\/code><\/pre>\n
In this example, the attacker spoofs the Origin header to match a trusted domain, thereby bypassing the permission check and activating the premium features.<\/p>\n
Recommended Mitigation Steps<\/strong><\/p>\n
To mitigate this vulnerability, it’s recommended to apply the vendor patch. In its absence, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) could serve as a temporary solution. Regularly updating and patching software is an essential part of maintaining an effective security posture.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview CVE-2025-7664 is a serious security vulnerability that affects the AL Pack plugin for WordPress. The flaw, which allows unauthenticated users to gain unauthorized access and activate premium features, could potentially lead to system compromise or data leakage. The widespread use of WordPress makes this vulnerability particularly problematic, warranting immediate attention and action. Vulnerability Summary […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-86811","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t