The vulnerability is a business‑logic flaw in Thelia that counts coupon usage only when orders become paid. An authenticated customer can place several pay‑later orders while the coupon usage remains uncounted, or cancel paid orders to reduce the recorded usage, enabling them to claim coupons repeatedly. The result is that an attacker can obtain unlimited discounts, directly affecting the site’s revenue and potentially devaluing legitimate promotional offers.

Vendors: Thelia Thelia. Product: Thelia website platform. Versions affected: any release prior to 3.1.5 and any release of the 3.2 series prior to 3.2.4. Users running 3.1.x below 3.1.5 or 3.2.x below 3.2.4 are vulnerable.

The CVSS score is 5.3, indicating a moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV, suggesting the exploitation risk in the wild is uncertain but potentially significant. The attack is carried out by an authenticated user who places pay‑later orders or cancels them, a scenario likely achievable by anyone with normal customer access. Given the moderate score and the lack of publicly documented exploits, the immediate risk is assessed as moderate, yet the financial impact to the business is still considerable.