CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in Josh Kohlbach Advanced Coupons for WooCommerce Coupons advanced-coupons-for-woocommerce-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Coupons for WooCommerce Coupons: from n/a through <= 4.7.1.
Explanation of Vulnerability in Simple Terms
Advanced Coupons for WooCommerce versions up to 4.7.1 fail to properly check user permissions before allowing access to certain coupon data. A logged-in user with low privileges can read coupon information they should not have access to. Update to a version newer than 4.7.1 to resolve this issue.
What an attacker can do
Read coupon data and settings they should not have permission to access.
Potential impact on your site
Customer or low-privilege user accounts can view sensitive coupon details, potentially exposing business pricing strategy or promotional mechanics.
Conditions required to exploit
Attacker must be logged in to the WordPress site with a low-privilege account (e.g., subscriber or customer).
Key dates
External resources
Related vulnerabilities
