CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
What the vulnerability does
Missing Authorization vulnerability in WebToffee Smart Coupons for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Smart Coupons for WooCommerce: from n/a before 2.3.0.
Explanation of Vulnerability in Simple Terms
Smart Coupons for WooCommerce before version 2.3.0 lacks proper authorization checks, allowing unauthenticated attackers to modify coupon data through the plugin's API or admin functions. An attacker can change coupon values, expiration dates, or usage limits without logging in. This affects all WooCommerce sites running the vulnerable plugin version.
What an attacker can do
Modify or delete coupons and their settings without authentication.
Potential impact on your site
Attackers can alter coupon codes, discount amounts, and restrictions, disrupting sales and customer trust.
Conditions required to exploit
Network access to the site; no login or user interaction required.
Key dates
External resources
Related vulnerabilities
