CVE-2025-66154
Lifecycle Timeline
2Description
Missing Authorization vulnerability in merkulove Couponer for Elementor couponer-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Couponer for Elementor: from n/a through <= 1.1.7.
Analysis
Missing authorization in Merkulove Couponer for Elementor plugin versions up to 1.1.7 allows unauthenticated attackers to bypass access controls and exploit incorrectly configured security levels, potentially gaining unauthorized access to sensitive coupon management functionality. The vulnerability carries low real-world exploitation probability (EPSS 0.02%) despite being classified as an authentication bypass, suggesting limited practical attack surface or requirement for specific configuration conditions.
Technical Context
This vulnerability stems from broken access control (CWE-862), a failure to properly enforce authorization checks on protected resources. Couponer for Elementor is a WordPress plugin that integrates with the Elementor page builder to manage promotional coupons. The vulnerability indicates that the plugin fails to adequately verify user permissions before allowing access to certain administrative or coupon-related operations, potentially allowing unauthenticated users or users with insufficient privileges to perform restricted actions. This type of flaw is common in WordPress plugins that do not properly implement capability checks on AJAX endpoints or REST API routes.
Affected Products
Merkulove Couponer for Elementor WordPress plugin versions 1.1.7 and earlier are affected. The vulnerability was reported by Patchstack's audit team and documented in the Patchstack vulnerability database for the couponer-elementor plugin.
Remediation
Update Merkulove Couponer for Elementor to a patched version above 1.1.7 as soon as available from the official WordPress.org plugin repository or the vendor's website. Review the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/couponer-elementor/vulnerability/wordpress-couponer-for-elementor-plugin-1-1-7-broken-access-control-vulnerability for detailed patch availability and version information. As an interim measure, restrict plugin functionality to authenticated users only and review user role assignments to ensure least-privilege access to coupon management features.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today