{
 "id": "WPSEC-2026-1679",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1679/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1679/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1679/index.md",
 "title": "Coupon Creator <= 3.6.3 - Authenticated (Contributor+) Missing Authorization to Coupon Publishing via Duplicate Feature",
 "description": "The Coupon Creator plugin for WordPress is vulnerable to unauthorized coupon publishing via the coupon duplicate feature in all versions up to, and including, 3.6.3, due to duplicated coupons always being created with a 'publish' status without checking whether the current user has the publish_cctor_coupons capability. This makes it possible for authenticated attackers with Contributor-level access and above, who are not permitted to publish coupons, to publish coupons on the site and bypass the editorial review workflow.",
 "plugin": {
  "slug": "coupon-creator",
  "name": "Coupon Creator",
  "full_name": "Coupon Creator",
  "wordpress_org": "https://wordpress.org/plugins/coupon-creator/",
  "advisories_url": "https://wpsec.com/vuln/plugin/coupon-creator/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/coupon-creator"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.1",
    "from_inclusive": true,
    "to": "3.6.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.1 before 3.6.4"
  ]
 },
 "introduced_in": "3.1",
 "fixed_in": "3.6.4",
 "remediation": "Update to 3.6.4 or later.",
 "fix_released": "2026-10-25T23:19:15+00:00",
 "published": "2026-10-26T23:44:14+00:00",
 "updated": "2026-10-26T09:31:24.891763+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1679/",
  "https://plugins.svn.wordpress.org/coupon-creator/tags/3.6.4/",
  "https://wordpress.org/plugins/coupon-creator/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/coupon-creator",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-27"
 }
}