Smart Coupons for WooCommerce CVE-2026-45438

No special conditions - remote unauthenticated exploitation against default configurations of Smart Coupons for WooCommerce prior to 2.3.0 (CVSS AV:N/AC:L/PR:N/UI:N). The only prerequisites are that the vulnerable plugin is installed and activated on a reachable WordPress site running WooCommerce, and that the specific unauthorized endpoint is exposed (which is the default since WordPress AJAX and REST routes are publicly reachable by design). Limiting factors are minimal: the attacker does not need credentials, user interaction, or a non-default deployment, though impact is constrained to integrity (C:N/A:N) - confidentiality of customer data and site availability are not directly affected by this specific flaw.

CVSS 7.5 with vector AV:N/AC:L/PR:N/UI:N indicates trivially reachable, unauthenticated, network-based exploitation with no user interaction, and the C:N/I:H/A:N profile confirms the impact is integrity-only - typical of an unauthorized state-changing endpoint (e.g., creating, modifying, or applying coupons). The signals diverge: SSVC marks Exploitation as 'none' and EPSS sits at 0.03% (8th percentile), suggesting no observed exploitation despite the low complexity, but SSVC also marks the issue Automatable=yes, which means once a public PoC appears the bug is well-suited to mass scanning. The CVE is not on the CISA KEV list and no public exploit has been identified at time of analysis, so this should be prioritized as a 'patch promptly' rather than 'emergency' issue - particularly for e-commerce sites where coupon integrity directly maps to revenue loss.

An unauthenticated attacker sends a crafted HTTP request directly to a vulnerable plugin endpoint (likely an admin-ajax.php action or REST route) on a target WooCommerce store, invoking a coupon-management operation that should be restricted to administrators. Because the endpoint never validates the caller's capability, the attacker can create, modify, or manipulate coupons - for example issuing high-value discount codes for themselves or tampering with existing promotional logic. No public PoC has been identified at time of analysis, but the automatable nature of the bug means scanning tooling could be developed once technical details circulate.