{
 "id": "WPSEC-2026-1617",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1617/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1617/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1617/index.md",
 "title": "Coupon Affiliates – Affiliate Plugin for WooCommerce <= 8.7.0 - Unauthenticated Missing Authorization to Affiliate Registration",
 "description": "The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to Missing Authorization via the 'wcusage_submit_registration' AJAX action in all versions up to, and including, 8.7.0, due to the handler not checking the settings that disable affiliate registration or restrict it to logged-in users, while the nonce it requires is printed for logged-out visitors on the affiliate portal page. This makes it possible for unauthenticated attackers to submit affiliate applications and create user accounts even when the site owner has disabled affiliate registration.",
 "plugin": {
  "slug": "woo-coupon-usage",
  "name": "Coupon Affiliates – Affiliate Plugin for WooCommerce",
  "full_name": "Coupon Affiliates – Affiliate Plugin for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/woo-coupon-usage/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woo-coupon-usage/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woo-coupon-usage"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "8.7.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 8.7.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "8.7.1",
 "remediation": "Update to 8.7.1 or later.",
 "fix_released": "2026-10-23T17:37:21+00:00",
 "published": "2026-10-24T17:42:52+00:00",
 "updated": "2026-10-24T10:52:50.742313+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1617/",
  "https://plugins.svn.wordpress.org/woo-coupon-usage/tags/8.7.1/",
  "https://wordpress.org/plugins/woo-coupon-usage/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woo-coupon-usage",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-25"
 }
}