Vulnerabilities / Coupon Affiliates – Affiliate Plugin for WooCommerce / WPSEC-2026-1617
Coupon Affiliates – Affiliate Plugin for WooCommerce <= 8.7.0 - Unauthenticated Missing Authorization to Affiliate Registration
Medium 5.3
CWE-862Fixed in 8.7.1
- ID
- WPSEC-2026-1617
- Plugin
- Coupon Affiliates – Affiliate Plugin for WooCommerce (woo-coupon-usage)
- Affected
- all versions before 8.7.1
- Remediation
- Update to 8.7.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-25
- Attack surface
- Coupon Affiliates – Affiliate Plugin for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to Missing Authorization via the 'wcusage_submit_registration' AJAX action in all versions up to, and including, 8.7.0, due to the handler not checking the settings that disable affiliate registration or restrict it to logged-in users, while the nonce it requires is printed for logged-out visitors on the affiliate portal page. This makes it possible for unauthenticated attackers to submit affiliate applications and create user accounts even when the site owner has disabled affiliate registration.
References
- https://wpsec.com/vuln/WPSEC-2026-1617/
- https://plugins.svn.wordpress.org/woo-coupon-usage/tags/8.7.1/
- https://wordpress.org/plugins/woo-coupon-usage/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS