{
 "id": "WPSEC-2026-2484",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2484/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2484/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2484/index.md",
 "title": "Dynamic Pricing With Discount Rules for WooCommerce <= 5.1.0 - Authenticated (Shop Manager+) Insecure Direct Object Reference to Arbitrary Post Duplication, Modification, Status Change and Deletion via REST API",
 "description": "The Dynamic Pricing With Discount Rules for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference via several REST API handlers (rule duplication, status change, bulk actions, rule reordering, product list retrieval, and rule and product list saving) in all versions up to, and including, 5.1.0, due to missing validation on a user-controlled post ID. The handlers did not check that the ID belonged to the plugin's own discount rule or product list post types. This makes it possible for authenticated attackers with Shop Manager-level access (the manage_woocommerce capability) and above to permanently delete arbitrary posts, overwrite their title and clear their content, change their meta, duplicate them, or read their title, including posts of types their role cannot otherwise manage.",
 "plugin": {
  "slug": "aco-woo-dynamic-pricing",
  "name": "Dynamic Pricing With Discount Rules for WooCommerce",
  "full_name": "Dynamic Pricing With Discount Rules for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/aco-woo-dynamic-pricing/",
  "advisories_url": "https://wpsec.com/vuln/plugin/aco-woo-dynamic-pricing/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/aco-woo-dynamic-pricing"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.7,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.1.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.1.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.1.1",
 "remediation": "Update to 5.1.1 or later.",
 "fix_released": "2026-11-03T11:48:35+00:00",
 "published": "2026-11-04T14:58:24+00:00",
 "updated": "2026-11-04T13:58:14.686249+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2484/",
  "https://plugins.svn.wordpress.org/aco-woo-dynamic-pricing/tags/5.1.1/",
  "https://wordpress.org/plugins/aco-woo-dynamic-pricing/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/aco-woo-dynamic-pricing",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-04"
 }
}