Vulnerabilities / Coupon Creator / WPSEC-2026-1679
Coupon Creator <= 3.6.3 - Authenticated (Contributor+) Missing Authorization to Coupon Publishing via Duplicate Feature
Medium 4.3
CWE-862Fixed in 3.6.4
- ID
- WPSEC-2026-1679
- Plugin
- Coupon Creator (coupon-creator)
- Affected
- from 3.1 before 3.6.4
- Remediation
- Update to 3.6.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-27
- Attack surface
- Coupon Creator on WPSec AttackSurface
- Fix released
- Published
Description
The Coupon Creator plugin for WordPress is vulnerable to unauthorized coupon publishing via the coupon duplicate feature in all versions up to, and including, 3.6.3, due to duplicated coupons always being created with a 'publish' status without checking whether the current user has the publish_cctor_coupons capability. This makes it possible for authenticated attackers with Contributor-level access and above, who are not permitted to publish coupons, to publish coupons on the site and bypass the editorial review workflow.
References
- https://wpsec.com/vuln/WPSEC-2026-1679/
- https://plugins.svn.wordpress.org/coupon-creator/tags/3.6.4/
- https://wordpress.org/plugins/coupon-creator/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS