{
 "id": "WPSEC-2026-1680",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1680/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1680/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1680/index.md",
 "title": "Coupon Creator <= 3.6.3 - Authenticated (Contributor+) Insecure Direct Object Reference to Coupon Duplication",
 "description": "The Coupon Creator plugin for WordPress is vulnerable to Insecure Direct Object Reference via the coupon duplicate feature in all versions up to, and including, 3.6.3, due to the duplicate handler only checking the generic edit_cctor_coupons capability rather than the user's permission to edit the specific coupon being duplicated. This makes it possible for authenticated attackers with Contributor-level access and above to duplicate coupons belonging to other users, including unpublished draft, pending and password-protected coupons, copying their content, post password and post meta into a new coupon they own.",
 "plugin": {
  "slug": "coupon-creator",
  "name": "Coupon Creator",
  "full_name": "Coupon Creator",
  "wordpress_org": "https://wordpress.org/plugins/coupon-creator/",
  "advisories_url": "https://wpsec.com/vuln/plugin/coupon-creator/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/coupon-creator"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.1",
    "from_inclusive": true,
    "to": "3.6.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.1 before 3.6.4"
  ]
 },
 "introduced_in": "3.1",
 "fixed_in": "3.6.4",
 "remediation": "Update to 3.6.4 or later.",
 "fix_released": "2026-10-25T23:19:15+00:00",
 "published": "2026-10-26T23:44:14+00:00",
 "updated": "2026-10-26T09:31:24.891763+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1680/",
  "https://plugins.svn.wordpress.org/coupon-creator/tags/3.6.4/",
  "https://wordpress.org/plugins/coupon-creator/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/coupon-creator",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-27"
 }
}