# Dynamic Pricing With Discount Rules for WooCommerce <= 5.1.0 - Authenticated (Shop Manager+) Insecure Direct Object Reference to Arbitrary Post Duplication, Modification, Status Change and Deletion via REST API

- **ID:** WPSEC-2026-2484
- **Plugin:** Dynamic Pricing With Discount Rules for WooCommerce (`aco-woo-dynamic-pricing`), https://wordpress.org/plugins/aco-woo-dynamic-pricing/
- **Affected versions:** all versions before 5.1.1
- **Fixed in:** 5.1.1 (Update to 5.1.1 or later.)
- **Severity:** Medium 4.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/aco-woo-dynamic-pricing
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2484/

## Description

The Dynamic Pricing With Discount Rules for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference via several REST API handlers (rule duplication, status change, bulk actions, rule reordering, product list retrieval, and rule and product list saving) in all versions up to, and including, 5.1.0, due to missing validation on a user-controlled post ID. The handlers did not check that the ID belonged to the plugin's own discount rule or product list post types. This makes it possible for authenticated attackers with Shop Manager-level access (the manage_woocommerce capability) and above to permanently delete arbitrary posts, overwrite their title and clear their content, change their meta, duplicate them, or read their title, including posts of types their role cannot otherwise manage.

## References

- https://wpsec.com/vuln/WPSEC-2026-2484/
- https://plugins.svn.wordpress.org/aco-woo-dynamic-pricing/tags/5.1.1/
- https://wordpress.org/plugins/aco-woo-dynamic-pricing/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2484/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.