The vulnerability is a missing authorization flaw in the Coupon Affiliates WordPress plugin that allows attackers to perform functions that should be restricted to privileged users. Documented as CWE‑862, the flaw enables unauthorized users to access or modify coupon data and other privileged features, potentially compromising the confidentiality and integrity of promotional code management.

The issue affects the Coupon Affiliates plugin from any version up to 7.2.0, as released by Elliot Sowersby / RelyWP. WordPress sites that have installed or upgraded the plugin within that version range are impacted, and earlier releases remain vulnerable due to the missing access‑control checks.

The CVSS score of 5.3 indicates a medium severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA KEV. Attackers would need network or local access to the WordPress site and could exploit the bug by sending crafted requests to the plugin endpoints. Because the flaw originates from absent ACL checks, any authenticated user able to reach the endpoints could abuse it. Although the exploitation likelihood is low, the medium severity warrants prompt attention.