AL Pack WordPress Plugin Missing Authorization Vulnerability in REST API Endpoint

A vulnerability exists in the AL Pack plugin for WordPress, all versions through and including 1.0.2. The issue arises from a missing capability check in the check_activate_permission() callback for the /wp-json/presslearn/v1/activate REST API endpoint. This absence of proper authorization allows unauthenticated attackers to activate premium features by spoofing the Origin header. The callback accepts requests from trusted domains without verifying user authentication, capabilities, or nonce tokens.

Impact

Exploitation of this vulnerability allows unauthenticated users to activate premium features of the AL Pack WordPress plugin, bypassing normal authorization checks.