Smart Coupons WooCommerce CVE-2025-64358
MEDIUMSeverity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable via HTTP, low complexity, but PR:L required; only confidentiality impact as authorization bypass exposes read-only coupon data.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Missing Authorization vulnerability in WebToffee Smart Coupons for WooCommerce wt-smart-coupons-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Coupons for WooCommerce: from n/a through <= 2.2.3.
AnalysisAI
Broken access control in WebToffee's Smart Coupons for WooCommerce plugin (versions through 2.2.3) permits authenticated low-privileged users - such as subscribers or customers - to access coupon-related resources or functionality restricted to higher-privileged roles. The flaw stems from missing server-side authorization checks (CWE-862), allowing an attacker with any valid WordPress account to exploit incorrectly configured access control levels. No public exploit code or active exploitation has been identified; EPSS sits at 0.03% (8th percentile), indicating very low real-world exploitation probability at time of analysis.
Technical ContextAI
The affected component is the WordPress plugin wt-smart-coupons-for-woocommerce by WebToffee, a WooCommerce extension managing coupon workflows. CWE-862 (Missing Authorization) indicates the plugin exposes one or more REST API endpoints or AJAX actions without verifying that the requesting user holds the capability required to perform the action - a common WordPress plugin pattern where nonce checks are present but capability/role checks are omitted. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms this is network-reachable with low complexity and requires only a low-privileged authenticated session, consistent with a WordPress subscriber or WooCommerce customer account triggering the unprotected action.
Affected ProductsAI
WebToffee Smart Coupons for WooCommerce WordPress plugin, all versions from the initial release through and including version 2.2.3 (plugin slug: wt-smart-coupons-for-woocommerce). The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wt-smart-coupons-for-woocommerce/vulnerability/wordpress-smart-coupons-for-woocommerce-plugin-2-2-3-broken-access-control-vulnerability?_s_id=cve is the primary reference; no NVD CPE string was provided in the available data.
RemediationAI
Patch available per vendor advisory - upgrade the Smart Coupons for WooCommerce plugin beyond version 2.2.3 via the WordPress admin dashboard (Plugins > Installed Plugins > Update) or the WordPress.org plugin repository. Until a patched release is applied, compensating controls include: disabling open user registration on the WordPress site to prevent anonymous actors from obtaining the low-privileged accounts required for exploitation (Settings > General > uncheck 'Anyone can register'); or temporarily deactivating the plugin if coupon functionality is non-essential. Restricting WooCommerce customer registration to invite-only also removes the primary attacker foothold. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wt-smart-coupons-for-woocommerce/vulnerability/wordpress-smart-coupons-for-woocommerce-plugin-2-2-3-broken-access-control-vulnerability?_s_id=cve for the confirmed fixed version once published.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today