CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The WooCommerce Smart Coupons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the woocommerce_coupon_admin_init function in versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to send themselves gift certificates of any value, which could be redeemed for products sold on the victim’s storefront.
Explanation of Vulnerability in Simple Terms
WooCommerce Smart Coupons versions before 4.6.5 contain an authorization flaw that allows unauthenticated attackers to modify coupon data over the network. The vulnerability requires no user interaction and affects the integrity of coupon records. Site administrators should update to version 4.6.5 or later immediately.
What an attacker can do
Modify coupon data without authentication.
Potential impact on your site
Attackers can alter coupon terms, discounts, or validity without logging in, affecting sales and customer trust.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
