PT-2025-33530 · WordPress · Al Pack For Wordpress

Angus Girvan · Published 2025-08-16 · Updated 2025-08-21 · CVE-2025-7664

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: AL Pack for WordPress versions up to and including 1.0.2

Description: The AL Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the check activate permission() permission callback for the /wp-json/presslearn/v1/activate API endpoint. The callback reads the client-supplied Origin header and allows the request if it matches one of the trusted domains, without verifying user authentication, capabilities, or nonce tokens. This allows unauthenticated attackers to activate premium features by spoofing the Origin header.

Recommendations: AL Pack for WordPress versions up to and including 1.0.2: Update to a version beyond 1.0.2.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-7664

Affected Products

Al Pack For Wordpress

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-7664 · Security Note
• https://twitter.com/CVEnew/status/1956654787723981038 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1956586416529416253 · Twitter Post
• https://t.me/CVEtracker/30177 · Telegram Post
• https://plugins.trac.wordpress.org/browser/alpack/trunk/includes/api.php · Note
• https://twitter.com/offseq/status/1956596915744747690 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3346754 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/793a2096-3332-412e-a45a-a7367b1209a3?source=cve · Note
• https://wordpress.org/plugins/alpack/#developers · Note
• https://twitter.com/cracbot/status/1958484272852976025 · Twitter Post