What is the CVSS score of CVE-2026-45438?

CVE-2026-45438 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Smart Coupons for WooCommerce are affected by CVE-2026-45438?

WebToffee Smart Coupons for WooCommerce (versions prior to 2.3.0) permits unauthenticated manipulation of coupon records, creating a direct channel for attackers to unilaterally alter promotional…. A patch is available.

How to fix or mitigate CVE-2026-45438?

Within 24 hours: Update WebToffee Smart Coupons to version 2.3.0 or later across all WooCommerce instances. Within 7 days: Audit coupon transaction logs and promotional history for unauthorized modifications; validate current coupon validity and pricing terms. Within 30 days: Establish continuous monitoring on coupon endpoints and configure alerts for unauthorized data modifications.

Smart Coupons for WooCommerce CVE-2026-45438

EUVD-2026-31765 HIGH

Missing Authorization (CWE-862)

2026-05-25 Patchstack

GHSA-248h-mpmp-3vwh

WordPress Authentication Bypass Wordpress Plugin Smart Coupons For Woocommerce Webtoffee

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:44 vuln.today

Patch available

May 26, 2026 - 14:01 EUVD

CVE Published

May 25, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Missing Authorization vulnerability in WebToffee Smart Coupons for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Smart Coupons for WooCommerce: from n/a before 2.3.0.

AnalysisAI

Unauthenticated integrity compromise in WebToffee Smart Coupons for WooCommerce (versions before 2.3.0) allows remote attackers to bypass access controls and modify coupon-related data without authentication. The flaw stems from missing authorization checks (CWE-862) on plugin endpoints, and while no public exploit has been identified at time of analysis, SSVC flags the issue as automatable, meaning mass exploitation tooling could emerge rapidly. EPSS is currently low (0.03%) despite the network-exploitable nature of the bug.

Technical ContextAI

Smart Coupons for WooCommerce is a WordPress plugin from WebToffee (CPE cpe:2.3:a:webtoffee:smart_coupons_for_woocommerce) that extends WooCommerce with coupon, gift card, and store credit functionality. The root cause is CWE-862 (Missing Authorization), where one or more plugin handlers - typically AJAX actions or REST routes registered through WordPress's action hook system - fail to perform capability or nonce-based access checks before executing privileged operations. This class of bug is common in WordPress plugins that rely on WooCommerce's frontend session model and conflate 'logged-in customer' with 'authorized to perform administrative coupon operations,' or that omit current_user_can() / check_ajax_referer() guards entirely.

RemediationAI

Vendor-released patch: upgrade Smart Coupons for WooCommerce to version 2.3.0 or later via the WordPress plugin updater or by downloading the latest release from WebToffee; this is the primary and recommended fix per the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wt-smart-coupons-for-woocommerce/vulnerability/wordpress-smart-coupons-for-woocommerce-plugin-2-3-0-broken-access-control-vulnerability). If immediate upgrade is not possible, compensating controls include deploying a WordPress WAF rule (Patchstack, Wordfence, or equivalent) to block requests to the plugin's AJAX/REST endpoints from unauthenticated sources, restricting /wp-admin/admin-ajax.php actions associated with this plugin via web-server-level rules, or temporarily deactivating the plugin - note that deactivation will disable all coupon, gift card, and store-credit functionality and may impact active marketing campaigns, while WAF rules require tuning to avoid breaking legitimate customer-facing coupon flows.