Coupon Creator <= 3.6.3 - Authenticated (Contributor+) Insecure Direct Object Reference to Coupon Duplication
- ID
- WPSEC-2026-1680
- Plugin
- Coupon Creator (coupon-creator)
- Affected
- from 3.1 before 3.6.4
- Remediation
- Update to 3.6.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-27
- Attack surface
- Coupon Creator on WPSec AttackSurface
- Fix released
- Published
Description
The Coupon Creator plugin for WordPress is vulnerable to Insecure Direct Object Reference via the coupon duplicate feature in all versions up to, and including, 3.6.3, due to the duplicate handler only checking the generic edit_cctor_coupons capability rather than the user's permission to edit the specific coupon being duplicated. This makes it possible for authenticated attackers with Contributor-level access and above to duplicate coupons belonging to other users, including unpublished draft, pending and password-protected coupons, copying their content, post password and post meta into a new coupon they own.
References
- https://wpsec.com/vuln/WPSEC-2026-1680/
- https://plugins.svn.wordpress.org/coupon-creator/tags/3.6.4/
- https://wordpress.org/plugins/coupon-creator/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS