# Coupon Affiliates – Affiliate Plugin for WooCommerce <= 8.7.0 - Unauthenticated Missing Authorization to Affiliate Registration

- **ID:** WPSEC-2026-1617
- **Plugin:** Coupon Affiliates – Affiliate Plugin for WooCommerce (`woo-coupon-usage`), https://wordpress.org/plugins/woo-coupon-usage/
- **Affected versions:** all versions before 8.7.1
- **Fixed in:** 8.7.1 (Update to 8.7.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-25)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woo-coupon-usage
- **Fix released:** 2026-10-23
- **Published:** 2026-10-24
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1617/

## Description

The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to Missing Authorization via the 'wcusage_submit_registration' AJAX action in all versions up to, and including, 8.7.0, due to the handler not checking the settings that disable affiliate registration or restrict it to logged-in users, while the nonce it requires is printed for logged-out visitors on the affiliate portal page. This makes it possible for unauthenticated attackers to submit affiliate applications and create user accounts even when the site owner has disabled affiliate registration.

## References

- https://wpsec.com/vuln/WPSEC-2026-1617/
- https://plugins.svn.wordpress.org/woo-coupon-usage/tags/8.7.1/
- https://wordpress.org/plugins/woo-coupon-usage/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1617/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.