EUVD-2026-104082
GHSA-3mcp-jg87-j7wj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WooCommerce site with vulnerable plugin
-
ExploitSend crafted unauthenticated coupon-creation request
-
ExecutionServer creates 100%-off/free-shipping coupon
-
ImpactRedeem coupon at checkout for financial gain
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must be a WordPress site running the ActiveTrail for WooCommerce plugin version ≤1.2.6 with WooCommerce active, since exploitation specifically abuses the plugin's coupon-creation functionality that lacks an authorization check. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or non-default configuration is required - exploitation works against default installs reachable over the network. The practical limit is scope: the flaw only permits creating WooCommerce coupons (integrity, I:L), so impact is confined to discount/coupon fraud and does not grant data access or site takeover. |
| Impact | Signals are modestly consistent but point to a low-to-moderate, financially-motivated issue rather than a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation against WordPress sites running the plugin, but impact is deliberately scoped to integrity only (C:N/I:L/A:N) - no data disclosure, code execution, or availability loss - which is why the base score sits at 5.3 (Medium). Public exploit code exists (reported by WPScan), which raises practical exploitability, but the CVE is NOT in CISA KEV and no EPSS score was supplied, so there is no evidence of confirmed active exploitation or a quantified exploitation probability. No SSVC decision data was provided. The realistic risk is targeted abuse of e-commerce discount logic (coupon fraud / revenue loss) rather than site compromise; it is a genuine but bounded merchant-fraud priority, not a high-impact RCE. Note: the CPE lists the vendor as 'unknown' and affected-version data comes from EUVD/WPScan rather than a confirmed vendor advisory - verify fix availability directly with the plugin author. |
| Exploit ScenarioDerived | An unauthenticated attacker discovers a WooCommerce store running the ActiveTrail integration plugin (≤1.2.6) and sends a crafted request to the unprotected coupon-creation endpoint, which performs no authorization check (CWE-862). They generate a 100%-off or free-shipping coupon and redeem it at checkout to obtain goods for free. Public exploit guidance from WPScan exists, lowering the skill required to reproduce the attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Unauthenticated coupon creation in the ActiveTrail for WooCommerce WordPress plugin (all versions through 1.2.6) lets remote attackers mint arbitrary WooCommerce coupons, including 100%-off and free-shipping codes, without any credentials or user interaction. The defect is a missing authorization check on the plugin's coupon-generation routine (CWE-862), so any visitor who can reach the endpoint can write coupon data into the store; the assessed vector (AV:N/AC:L/PR:N/UI:N, I:L only) confirms default installs are reachable over the network while impact stays confined to integrity of discount data rather than data disclosure or site takeover. Publicly available exploit code exists and the finding is documented by WPScan and EUVD-2026-104082, but there is no CISA KEV entry - the practical threat is financially motivated coupon and discount fraud, not mass site compromise; no vendor-released patch is identified in the available data.
RemediationAI
No vendor-released patch is identified in the available data, and the advisory covers versions through 1.2.6, so the safest immediate action is to deactivate and remove the ActiveTrail for WooCommerce plugin until the vendor publishes a fixed release - the trade-off is loss of ActiveTrail marketing/automation integration, which is preferable to open coupon creation. If the plugin cannot be removed, restrict access to the coupon-creation path at the edge: block unauthenticated POSTs to admin-ajax.php and the plugin's REST namespace via WAF or reverse-proxy rules, accepting that this may break legitimate storefront-side plugin features that rely on those routes. Audit the WooCommerce coupon table now for unauthorized 100%-off and free-shipping codes, disable or delete them, and review recent orders for discount abuse; also cap maximum coupon value and require usage limits on new coupons to bound future fraud. Add monitoring/alerting on coupon creation events, and track https://wpscan.com/vulnerability/0865bdd3-8ce9-4a3b-a174-07076dee8565/ plus https://nvd.nist.gov/vuln/detail/CVE-2026-106028 for a patched version; upgrade as soon as one is published and re-enable the plugin only after verification.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue sits in the ActiveTrail for WooCommerce plugin, an integration that bridges the ActiveTrail marketing/automation platform with WooCommerce stores on WordPress. WooCommerce exposes coupon objects through its CRUD layer (WC_Coupon) and typically gates creation behind WordPress capability checks such as manage_woocommerce plus nonce verification on admin-ajax or REST routes. Here the plugin's coupon-creation handler performs no capability or nonce/authorization check at all - the CWE-862 (Missing Authorization) root cause - so the request is processed with the privileges of an anonymous visitor. Because WooCommerce accepts coupon amounts up to 100% and free-shipping flags, the only bound on impact is the attacker's ability to reach the endpoint, not any privilege boundary. The CPE entry (cpe:2.3:a:unknown:activetrail_for_woocommerce) shows the plugin is not yet mapped to a known vendor in the CPE dictionary, so asset inventories keyed to CPE alone may miss installations; the WPScan vulnerability record (0865bdd3-8ce9-4a3b-a174-07076dee8565) is the authoritative identifier for scanners. WooCommerce must be active for exploitation, since the abused functionality is coupon creation itself.
Know when Activetrail For Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated remote request with no interaction (AV:N/AC:L/PR:N/UI:N); only unauthorized coupon creation, so I:L with C:N/A:N and no scope change.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons, allowing unauthenticated attackers to create arbitrary coupons, including 100%-off and free-shipping coupons.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB