Medium severity · published Oct 16, 2024
CVE-2020-36841
WooCommerce Smart Coupons <= 4.6.0 - Unauthenticated Coupon Creation
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
The WooCommerce Smart Coupons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the woocommerce_coupon_admin_init function in versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to send themselves gift certificates of any value, which could be redeemed for products sold on the victim’s storefront.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
WooCommerce Smart Coupons · WooCommerce
before 4.6.5 · source: vendor, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-36841
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-36841
www.wordfence.com
https://www.wordfence.com/blog/2020/03/coupon-creation-vulnerability-patched-in-woocommerce-smart-coupons/
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/eeeb03f7-5f78-4462-b0b4-5080bbc419a3?source=cve