The plugin has two AJAX actions, mep_wl_ajax_license_activate and mep_wl_ajax_license_deactivate, which are available to both unauthenticated and authenticated users, and are lacking any authorisation, CSRF as well as checks to ensure that the options to be updated belong to the plugin. As a result, unauthenticated users can reset arbitrary blog options (as they will be set to ''), for example disabling the user registration, or disabling all active plugins.
Proof of Concept
To disable user registration:
To disable all plugins: https://example.com/wp-admin/admin-ajax.php?action=mep_wl_ajax_license_deactivate&key_option_name=active_plugins