WooCommerce Smart Coupons <= 4.6.0 - Unauthenticated Coupon Creation
Priority LOW 29CWE-285Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-285.
Summary
The WooCommerce Smart Coupons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the woocommerce_coupon_admin_init function in versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to send themselves gift certificates of any value, which could be redeemed for products sold on the victim’s storefront.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00213 11th percentileScored 2026-11-07
Fix Fixed WooCommerce Smart Coupons (WooCommerce): 4.6.5
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| WooCommerce | WooCommerce Smart Coupons | before 4.6.5 | 4.6.5 | Patch available | CNA |
- WooCommerce Smart Coupons VendorWooCommerce Affected before 4.6.5 Fixed in 4.6.5 Patch available CNA
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:woocommerce:woocommerce_smart_coupons:*:*:*:*:*:*:*:* | — | — | WooCommerce |
- cpe:2.3:a:woocommerce:woocommerce_smart_coupons:*:*:*:*:*:*:*:* Versions — — ·WooCommerce
Remediation
- Fix · CNA WooCommerce Smart Coupons (WooCommerce) Fixed in 4.6.5
Timeline
- 2026-10-02 Threatist record created from CVE-2020-36841
- 2026-10-03 Alias added: GHSA-x279-24jv-7gr3
References
More WooCommerce vulnerabilities
- TI-2023-03274 WooCommerce Pre-Orders < 2.0.3 - Unauthorised Actions via CSRF CVSS 3.1MEDIUM 6.5
- TI-2023-03273 WooCommerce Pre-Orders < 2.0.3 - Arbitrary Pre-Order Canceling via CSRF CVSS 3.1MEDIUM 6.5
- TI-2023-02044 WooCommerce Order Status Change Notifier <= 1.1.0 - Subscriber+ Arbitrary Order Status Update CVSS 3.1MEDIUM 6.5
- TI-2022-00684 WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion CVSS 3.1MEDIUM 4.3
- TI-2021-06504 WooCommerce Help Scout < 2.9.1 - Unauthenticated Arbitrary File Upload leading to RCE CVSS 3.1CRITICAL 9.8
- TI-2023-17950 WordPress WooCommerce Product Vendors Plugin <= 2.1.78 is vulnerable to SQL Injection CVSS 3.1CRITICAL 9.8
Sources
- CVE-2020-36841 · CVE Program
- CVE-2020-36841 · NVD
- FIRST EPSS
- GHSA-x279-24jv-7gr3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences