CVE-2025-52726 HIGH

CVE-2025-52726: WordPress CouponXxL Custom Post Types plugin <= 3.0 - Privilege Escalation Vulnerability

Vendor Pebas
Product CouponXxL Custom Post Types
Weakness CWE-266
Published June 27, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

What the vulnerability does

01Description

Incorrect Privilege Assignment vulnerability in pebas CouponXxL Custom Post Types couponxxl-cpt allows Privilege Escalation.This issue affects CouponXxL Custom Post Types: from n/a through <= 3.0.

Explanation of Vulnerability in Simple Terms

02Summary

CouponXxL Custom Post Types versions 3.0 and earlier contain an improper access control vulnerability. An unauthenticated attacker can read sensitive data and make limited modifications to the site without needing to log in or interact with a user. The vulnerability affects the core functionality of the plugin and requires no special conditions to exploit.

What an attacker can do

03Attacker Capabilities

Read sensitive data and make limited changes to the site without authentication.

Potential impact on your site

04Site Impact

Unauthorized users can access and modify plugin data without logging in, potentially exposing customer information or coupon details.

Conditions required to exploit

05Prerequisites

Network access to the site; no authentication or user interaction required.

Key dates

06Disclosure timeline

June 27, 2025 CVE published
April 28, 2026 Record updated