{
 "id": "WPSEC-2026-2961",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2961/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2961/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2961/index.md",
 "title": "WooCommerce Payments <= 11.2.1 - Unauthenticated Coupon Usage Limit Bypass via WooPay Preflight Check Flag",
 "description": "The WooPayments: Integrated WooCommerce Payments plugin for WordPress is vulnerable to a coupon usage limit bypass via the 'is-woopay-preflight-check' payment data flag in versions 7.2.0 up to, and including, 11.2.1, due to the plugin trusting this flag on any REST API request, such as Store API cart and checkout requests, without checking that WooPay sent the request. When the flag is set, the gateway leaves the order pending without charging it and without recording its coupon usage, and from version 10.1.0 the remove_all_actions_on_preflight_check() function also turns off coupon usage limits (usage_limit and usage_limit_per_user) for that request. This makes it possible for unauthenticated attackers to use limited coupons beyond their configured usage limits (in versions before 10.1.0, once per coupon hold period), place orders at the discounted price, and then pay for those orders on the pay-for-order page.",
 "plugin": {
  "slug": "woocommerce-payments",
  "name": "WooCommerce Payments",
  "full_name": "WooPayments: Integrated WooCommerce Payments",
  "wordpress_org": "https://wordpress.org/plugins/woocommerce-payments/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woocommerce-payments/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woocommerce-payments"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-345"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "7.2.0",
    "from_inclusive": true,
    "to": "11.3.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 7.2.0 before 11.3.0"
  ]
 },
 "introduced_in": "7.2.0",
 "fixed_in": "11.3.0",
 "remediation": "Update to 11.3.0 or later.",
 "fix_released": "2026-11-11T12:29:25+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:12:46.973144+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2961/",
  "https://plugins.svn.wordpress.org/woocommerce-payments/tags/11.3.0/",
  "https://wordpress.org/plugins/woocommerce-payments/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woocommerce-payments",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-11-12"
 }
}