Dynamic Pricing With Discount Rules for WooCommerce <= 5.1.0 - Authenticated (Shop Manager+) Insecure Direct Object Reference to Arbitrary Post Duplication, Modification, Status Change and Deletion via REST API
- ID
- WPSEC-2026-2484
- Plugin
- Dynamic Pricing With Discount Rules for WooCommerce (aco-woo-dynamic-pricing)
- Affected
- all versions before 5.1.1
- Remediation
- Update to 5.1.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-04
- Attack surface
- Dynamic Pricing With Discount Rules for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Dynamic Pricing With Discount Rules for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference via several REST API handlers (rule duplication, status change, bulk actions, rule reordering, product list retrieval, and rule and product list saving) in all versions up to, and including, 5.1.0, due to missing validation on a user-controlled post ID. The handlers did not check that the ID belonged to the plugin's own discount rule or product list post types. This makes it possible for authenticated attackers with Shop Manager-level access (the manage_woocommerce capability) and above to permanently delete arbitrary posts, overwrite their title and clear their content, change their meta, duplicate them, or read their title, including posts of types their role cannot otherwise manage.
References
- https://wpsec.com/vuln/WPSEC-2026-2484/
- https://plugins.svn.wordpress.org/aco-woo-dynamic-pricing/tags/5.1.1/
- https://wordpress.org/plugins/aco-woo-dynamic-pricing/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS