CVE-2020-36841
WooCommerce Smart Coupons <= 4.6.0 - Unauthenticated Coupon Creation
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 16, 2024
- Updated
- Apr 8, 2026
- Reserved
- Oct 15, 2024
Description
The WooCommerce Smart Coupons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the woocommerce_coupon_admin_init function in versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to send themselves gift certificates of any value, which could be redeemed for products sold on the victim’s storefront.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | Wordfence |
Weaknesses
- CWE-285 Improper Authorization
Affected Products
| Product | Versions |
|---|---|
WooCommerce Smart CouponsWooCommerce |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.