{
 "id": "WPSEC-2026-1619",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1619/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1619/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1619/index.md",
 "title": "Coupon Affiliates – Affiliate Plugin for WooCommerce <= 8.7.0 - Authenticated (Shop Manager+) Privilege Escalation via Account Takeover",
 "description": "The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 8.7.0, due to the 'View Affiliate' user update and delete handlers and the affiliate and coupon list bulk delete actions not checking whether the current user may manage the target user. This makes it possible for authenticated attackers who have been given the plugin's Admin Permissions, such as Shop Managers, to change the email address of any user, including administrators, and take over their accounts, or to delete higher-privileged users.",
 "plugin": {
  "slug": "woo-coupon-usage",
  "name": "Coupon Affiliates – Affiliate Plugin for WooCommerce",
  "full_name": "Coupon Affiliates – Affiliate Plugin for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/woo-coupon-usage/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woo-coupon-usage/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woo-coupon-usage"
 },
 "type": "PRIV",
 "cwe": [
  "CWE-269"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "8.7.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 8.7.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "8.7.1",
 "remediation": "Update to 8.7.1 or later.",
 "fix_released": "2026-10-23T17:37:21+00:00",
 "published": "2026-10-24T17:42:52+00:00",
 "updated": "2026-10-24T10:52:50.742313+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1619/",
  "https://plugins.svn.wordpress.org/woo-coupon-usage/tags/8.7.1/",
  "https://wordpress.org/plugins/woo-coupon-usage/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woo-coupon-usage",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-25"
 }
}