CVE-2022-23975

The Access Demo Importer plugin before version 1.0.8 contains a flaw in its AJAX handlers for plugin activation and deactivation that fail to verify user permissions or nonce tokens. An authenticated user with subscriber-level access can exploit this to activate or deactivate any plugin on the site, potentially disabling security tools and creating opportunities for further attacks.

Based on public CVE data (MITRE/NVD).