# Coupon Creator <= 3.6.3 - Authenticated (Contributor+) Insecure Direct Object Reference to Coupon Duplication

- **ID:** WPSEC-2026-1680
- **Plugin:** Coupon Creator (`coupon-creator`), https://wordpress.org/plugins/coupon-creator/
- **Affected versions:** from 3.1 before 3.6.4
- **Fixed in:** 3.6.4 (Update to 3.6.4 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/coupon-creator
- **Fix released:** 2026-10-25
- **Published:** 2026-10-26
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1680/

## Description

The Coupon Creator plugin for WordPress is vulnerable to Insecure Direct Object Reference via the coupon duplicate feature in all versions up to, and including, 3.6.3, due to the duplicate handler only checking the generic edit_cctor_coupons capability rather than the user's permission to edit the specific coupon being duplicated. This makes it possible for authenticated attackers with Contributor-level access and above to duplicate coupons belonging to other users, including unpublished draft, pending and password-protected coupons, copying their content, post password and post meta into a new coupon they own.

## References

- https://wpsec.com/vuln/WPSEC-2026-1680/
- https://plugins.svn.wordpress.org/coupon-creator/tags/3.6.4/
- https://wordpress.org/plugins/coupon-creator/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1680/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.