The vulnerability is a missing authorization flaw in the VillaTheme Customer Coupons for WooCommerce plugin. Incorrectly configured access control levels allow any user, authenticated or not, to trigger coupon functions that are meant to be restricted. This can enable a malicious actor to create or activate premium coupons, bypassing normal purchase restrictions and potentially inflating revenue through fraudulent use.

WordPress sites that have installed the Customer Coupons for WooCommerce plugin from the initial release through 1.3.14 are affected. Site administrators should verify the installed plugin version and upgrade if necessary.

The CVSS base score of 4.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited reported exploitation. The flaw can be exploited remotely by sending HTTP requests to the plugin’s endpoints, without the need for privileged credentials. Although the attack surface is exposed, the impact is confined to unauthorized coupon operations, but it remains a significant concern for sites relying on this plugin.