# Coupon Affiliates – Affiliate Plugin for WooCommerce <= 8.7.0 - Authenticated (Shop Manager+) Privilege Escalation via Account Takeover

- **ID:** WPSEC-2026-1619
- **Plugin:** Coupon Affiliates – Affiliate Plugin for WooCommerce (`woo-coupon-usage`), https://wordpress.org/plugins/woo-coupon-usage/
- **Affected versions:** all versions before 8.7.1
- **Fixed in:** 8.7.1 (Update to 8.7.1 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-269
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-25)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woo-coupon-usage
- **Fix released:** 2026-10-23
- **Published:** 2026-10-24
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1619/

## Description

The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 8.7.0, due to the 'View Affiliate' user update and delete handlers and the affiliate and coupon list bulk delete actions not checking whether the current user may manage the target user. This makes it possible for authenticated attackers who have been given the plugin's Admin Permissions, such as Shop Managers, to change the email address of any user, including administrators, and take over their accounts, or to delete higher-privileged users.

## References

- https://wpsec.com/vuln/WPSEC-2026-1619/
- https://plugins.svn.wordpress.org/woo-coupon-usage/tags/8.7.1/
- https://wordpress.org/plugins/woo-coupon-usage/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1619/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.