What is the CVSS score of CVE-2026-31919?

CVE-2026-31919 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Advanced Coupons For Woocommerce Coupons are affected by CVE-2026-31919?

CVE-2026-31919 presents moderate security risk, a missing authorization vulnerability rated CVSS 4.3. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-31919?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Advanced Coupons For Woocommerce Coupons CVE-2026-31919

EUVD-2026-11796 MEDIUM

Missing Authorization (CWE-862)

2026-03-13 Patchstack

WordPress Authentication Bypass Advanced Coupons For Woocommerce Coupons Wordpress Plugin Josh Kohlbach

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-11796

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:41 nvd

MEDIUM 4.3

DescriptionCVE.org

Missing Authorization vulnerability in Josh Kohlbach Advanced Coupons for WooCommerce Coupons advanced-coupons-for-woocommerce-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Coupons for WooCommerce Coupons: from n/a through <= 4.7.1.

AnalysisAI

Advanced Coupons for WooCommerce Coupons through version 4.7.1 contains an authorization bypass vulnerability that allows authenticated users to access restricted functionality by exploiting misconfigured access controls. An attacker with valid WordPress credentials could leverage this vulnerability to view or modify coupon data they are not authorized to access. No patch is currently available for this vulnerability.

Technical ContextAI

The vulnerability stems from CWE-862 (Missing Authorization), a common flaw in WordPress plugin development where access control checks are either absent or improperly implemented at the application layer. Advanced Coupons for WooCommerce (CPE: cpe:2.3:a:josh_kohlbach:advanced-coupons-for-woocommerce-free or similar designation) is a WooCommerce extension that extends e-commerce functionality through custom coupon management APIs and administrative interfaces. The plugin fails to enforce proper capability checks (using WordPress nonces, role-based access control via wp_get_current_user(), or similar mechanisms) on coupon data endpoints, allowing users to bypass intended authorization barriers. This is particularly dangerous in multi-tenant or multi-role WooCommerce environments where customer-tier users should never access coupon creation, modification, or analytics data.

RemediationAI

Immediately upgrade Advanced Coupons for WooCommerce to the latest patched version (confirmed to be later than 4.7.1) via the WordPress admin Plugins page or by downloading directly from the official WordPress plugin repository. Verify the upgrade by confirming the new version number in the plugin details. As a temporary workaround prior to upgrading, restrict access to the WooCommerce admin panel using IP whitelisting or Web Application Firewall (WAF) rules to limit exposure to trusted internal networks only, and audit user roles to ensure customers and low-privileged users do not have 'shop_manager' or equivalent capabilities. Test the upgrade in a staging environment before production deployment to ensure compatibility with other WooCommerce extensions. Monitor the vendor's security advisory page for any additional guidance or follow-up patches.