CVE-2026-55795 MEDIUM

CVE-2026-55795: Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass

Vendor Craftcms
Product commerce
Weakness CWE-307 · Brute force
Published September 14, 2026
Last update September 14, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its RateLimiter only when the number POST or GET parameter is supplied. An unauthenticated attacker can submit couponCode values to actionUpdateCart for the session-based cart while omitting number, preventing creation of the IP rate-limit identity and allowing unlimited automated coupon-code guessing and enumeration. This issue is fixed in versions 4.11.2 and 5.6.5.

Key dates

02Disclosure timeline

September 14, 2026 CVE published

Related vulnerabilities

04Related CVE

CVE-2024-35747 WordPress Contact Form Builder, Contact Widget plugin <= 2.1.7 - Bypass Vulnerability vulnerability CVE-2026-15079 Login Disable - Moderately critical - Access bypass - SA-CONTRIB-2026-070 CVE-2023-35039 WordPress Password Reset with Code for WordPress REST API Plugin <= 0.0.15 is vulnerable to Broken Authentication CVE-2025-9551 Protected Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-101 CVE-2023-45009 WordPress Captcha for Contact Form 7 plugin <= 1.11.3 - Capcha Bypass vulnerability