Coupon Affiliates – Affiliate Plugin for WooCommerce <= 8.7.0 - Authenticated (Shop Manager+) Privilege Escalation via Account Takeover
- ID
- WPSEC-2026-1619
- Plugin
- Coupon Affiliates – Affiliate Plugin for WooCommerce (woo-coupon-usage)
- Affected
- all versions before 8.7.1
- Remediation
- Update to 8.7.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-269
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-25
- Attack surface
- Coupon Affiliates – Affiliate Plugin for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 8.7.0, due to the 'View Affiliate' user update and delete handlers and the affiliate and coupon list bulk delete actions not checking whether the current user may manage the target user. This makes it possible for authenticated attackers who have been given the plugin's Admin Permissions, such as Shop Managers, to change the email address of any user, including administrators, and take over their accounts, or to delete higher-privileged users.
References
- https://wpsec.com/vuln/WPSEC-2026-1619/
- https://plugins.svn.wordpress.org/woo-coupon-usage/tags/8.7.1/
- https://wordpress.org/plugins/woo-coupon-usage/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS