WooCommerce Payments <= 11.2.1 - Unauthenticated Coupon Usage Limit Bypass via WooPay Preflight Check Flag
- ID
- WPSEC-2026-2961
- Plugin
- WooPayments: Integrated WooCommerce Payments (woocommerce-payments)
- Affected
- from 7.2.0 before 11.3.0
- Remediation
- Update to 11.3.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-12
- Attack surface
- WooCommerce Payments on WPSec AttackSurface
- Fix released
- Published
Description
The WooPayments: Integrated WooCommerce Payments plugin for WordPress is vulnerable to a coupon usage limit bypass via the 'is-woopay-preflight-check' payment data flag in versions 7.2.0 up to, and including, 11.2.1, due to the plugin trusting this flag on any REST API request, such as Store API cart and checkout requests, without checking that WooPay sent the request. When the flag is set, the gateway leaves the order pending without charging it and without recording its coupon usage, and from version 10.1.0 the remove_all_actions_on_preflight_check() function also turns off coupon usage limits (usage_limit and usage_limit_per_user) for that request. This makes it possible for unauthenticated attackers to use limited coupons beyond their configured usage limits (in versions before 10.1.0, once per coupon hold period), place orders at the discounted price, and then pay for those orders on the pay-for-order page.
References
- https://wpsec.com/vuln/WPSEC-2026-2961/
- https://plugins.svn.wordpress.org/woocommerce-payments/tags/11.3.0/
- https://wordpress.org/plugins/woocommerce-payments/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS