This vulnerability is a missing authorization flaw that allows an attacker to perform privileged actions on the Smart Coupons for WooCommerce plugin. Because access controls are incorrectly configured, an unintended user can create, modify, or delete coupons, or otherwise manipulate coupon data, potentially affecting the store’s revenue, customer trust, and financial operations. The weakness is a direct example of flawed permission enforcement and is listed as CWE‑862.

The issue affects all installations of the WebToffee Smart Coupons for WooCommerce plugin running any version earlier than 2.3.0. Any WordPress site using this plugin and running those versions is exposed.

The CVSS score of 7.5 classifies the vulnerability as high severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, so there is no public record of exploitation yet. The likely attack vector is through web API or administrative interfaces that do not perform correct authorization checks. An authenticated user with insufficient privileges could exploit the flaw, or an unauthenticated attacker may target public endpoints if they are exposed. Given the high severity and the absence of a publicly documented exploit, the risk remains significant for affected sites until the vulnerability is patched.