Description
The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons, allowing unauthenticated attackers to create arbitrary coupons, including 100%-off and free-shipping coupons.
Published: 2026-10-19
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unrestricted Coupon Creation
Action: Upgrade Plugin
AI Analysis

Impact

The ActiveTrail for WooCommerce plugin for WordPress, versions up to 1.2.6, has no authorization check before allowing coupon creation. An attacker can create arbitrary WooCommerce coupons, including 100%‑off or free‑shipping coupons, resulting in unauthorized discounts that can lead to financial loss for merchants. This vulnerability does not compromise system confidentiality or availability directly.

Affected Systems

WordPress sites that run the ActiveTrail for WooCommerce plugin version 1.2.6 or earlier are affected. The issue is limited to the plugin and does not impact other components of the WordPress installation.

Risk and Exploitability

The exploit requires only unauthenticated HTTP requests to the plugin’s coupon creation endpoint, making the attack vector low effort and high feasibility for exposed sites. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.3 indicates moderate severity, but the potential for financial loss remains high.

Generated by OpenCVE AI on October 19, 2026 at 11:56 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the ActiveTrail for WooCommerce plugin to the latest available version that implements proper authorization checks for coupon creation.
  • Limit the coupon creation API to authenticated WordPress users with the appropriate capabilities, ensuring that only authorized staff can create discounts.
  • Audit existing coupons for unauthorized entries and revoke any that appear to have been created without proper authorization to prevent further loss.

Generated by OpenCVE AI on October 19, 2026 at 11:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Mon, 19 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-862
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Mon, 19 Oct 2026 06:15:00 +0000

Type Values Removed Values Added
Description The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons, allowing unauthenticated attackers to create arbitrary coupons, including 100%-off and free-shipping coupons.
Title ActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-10-19T09:31:20.161Z

Reserved: 2026-10-06T13:15:42.116Z

Link: CVE-2026-106028

cve-icon Vulnrichment

Updated: 2026-10-19T09:23:03.802Z

cve-icon NVD

Status : Received

Published: 2026-10-19T06:17:20.510

Modified: 2026-10-19T10:16:44.010

Link: CVE-2026-106028

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T12:00:16Z

Weaknesses