# WooCommerce Payments <= 11.2.1 - Unauthenticated Coupon Usage Limit Bypass via WooPay Preflight Check Flag

- **ID:** WPSEC-2026-2961
- **Plugin:** WooPayments: Integrated WooCommerce Payments (`woocommerce-payments`), https://wordpress.org/plugins/woocommerce-payments/
- **Affected versions:** from 7.2.0 before 11.3.0
- **Fixed in:** 11.3.0 (Update to 11.3.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woocommerce-payments
- **Fix released:** 2026-11-11
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2961/

## Description

The WooPayments: Integrated WooCommerce Payments plugin for WordPress is vulnerable to a coupon usage limit bypass via the 'is-woopay-preflight-check' payment data flag in versions 7.2.0 up to, and including, 11.2.1, due to the plugin trusting this flag on any REST API request, such as Store API cart and checkout requests, without checking that WooPay sent the request. When the flag is set, the gateway leaves the order pending without charging it and without recording its coupon usage, and from version 10.1.0 the remove_all_actions_on_preflight_check() function also turns off coupon usage limits (usage_limit and usage_limit_per_user) for that request. This makes it possible for unauthenticated attackers to use limited coupons beyond their configured usage limits (in versions before 10.1.0, once per coupon hold period), place orders at the discounted price, and then pay for those orders on the pay-for-order page.

## References

- https://wpsec.com/vuln/WPSEC-2026-2961/
- https://plugins.svn.wordpress.org/woocommerce-payments/tags/11.3.0/
- https://wordpress.org/plugins/woocommerce-payments/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2961/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.