CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in Imtiaz Rayhan WP Coupons and Deals wp-coupons-and-deals allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Coupons and Deals: from n/a through <= 3.2.4.
Explanation of Vulnerability in Simple Terms
WP Coupons and Deals through version 3.2.4 lacks proper authorization checks, allowing authenticated users with low privileges to modify coupon data they should not have access to. An attacker with a basic user account can alter coupon settings or content without restriction. The vulnerability requires a valid WordPress login but does not affect site availability or expose sensitive data.
What an attacker can do
Modify coupon data and settings with a low-privilege user account.
Potential impact on your site
Coupon campaigns may be altered or sabotaged by low-privilege users, affecting promotions and customer trust.
Conditions required to exploit
Attacker must have a valid WordPress user account with low privileges.
Key dates
External resources
