EUVD-2026-89820
GHSA-hpvj-r322-49wr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Contributor account on target site
-
DeliveryEnumerate coupon/PDF object IDs
-
ExploitSubmit request with another user's object ID
-
ExecutionBypass missing ownership check
-
ImpactTamper with victim coupon records (I:L/A:L)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitation requires an authenticated WordPress account at Contributor role or higher (PR:L) on a site running Flexible PDF Coupons version 1.14.11 or earlier; the attacker manipulates a direct object reference (object ID) to act on coupon/PDF records belonging to other users. Limiting factors: the attacker must first hold or acquire a Contributor account (sites that disable open registration or restrict low-privilege roles reduce exposure), no user interaction is needed (UI:N), and impact is bounded to low integrity and availability effects on the referenced objects - there is no confidentiality disclosure per the vector. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base 5.4) describes a network-reachable, low-complexity IDOR requiring an authenticated low-privilege account - the description specifies Contributor role, consistent with PR:L. Impact is limited: no confidentiality loss (C:N) and only low integrity and availability impact (I:L/A:L), meaning an attacker can tamper with or affect other users' objects (e.g. coupon/PDF records) rather than read sensitive data or fully deny service. No EPSS score, KEV listing, or POC is present in the input, so this reflects no public exploit identified at time of analysis and no evidence of active exploitation. This is a genuine but modest-severity authorization flaw, not a high-urgency issue: the PR:L requirement (attacker must already hold a Contributor account on the target WordPress site) and the capped I:L/A:L impact substantially limit real-world blast radius. Treat as a routine patch-cycle item rather than an emergency. Note the vector's C:N is somewhat unusual for an IDOR (which often exposes data) - the low integrity/availability-only profile suggests the flaw enables manipulation of coupon objects rather than disclosure; the sparse Patchstack description does not name the exact endpoint or object parameter, so the precise sink is unverified. |
| Exploit ScenarioDerived | An attacker registers or obtains a Contributor-level account on a WordPress site running Flexible PDF Coupons <= 1.14.11, then issues requests that reference another user's coupon or PDF object identifier without a proper ownership check. By incrementing or substituting the object ID they modify or affect coupon records they do not own. No public proof-of-concept is identified in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Authenticated IDOR in the WordPress plugin Flexible PDF Coupons (versions up to and including 1.14.11) lets a Contributor-level account manipulate object identifiers to act on coupon and PDF records it does not own. The vulnerability is network-reachable and low complexity, but requires a valid low-privilege WordPress account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base 5.4), and per the assessed vector the impact is limited to low integrity and availability effects with no confidentiality disclosure. No public exploit identified at time of analysis; there is no CISA KEV listing and no EPSS signal was provided, and no vendor-released patch version was identified in the available data.
RemediationAI
No vendor-released patch identified at time of analysis, and no fixed version is specified in the available data, so the primary action is to check the plugin's update channel and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/flexible-coupons/vulnerability/wordpress-flexible-pdf-coupons-plugin-1-14-11-insecure-direct-object-references-idor-vulnerability?_s_id=cve for a subsequently released fixed build and apply it as soon as it appears. Until then, compensating controls should target the PR:L prerequisite: disable open user registration and revoke or avoid granting the Contributor role to anyone who is not trusted, since withholding that role removes the attack path entirely (side effect: legitimate contributors must have accounts provisioned manually); review existing Contributor accounts and audit coupon/PDF records for unexpected modifications. If coupon generation is not business-critical, deactivate or remove the plugin, which eliminates exposure but breaks any live coupon workflows. As a narrower measure, block or rate-limit unauthenticated and low-privilege access to the plugin's AJAX/REST endpoints at the WAF or reverse-proxy layer, accepting that over-broad blocking can break legitimate front-end coupon functionality. Because Integrity and Availability impacts are assessed as low and Confidentiality as none, these mitigations are proportionate and no emergency site takedown is warranted.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-639, Authorization Bypass Through User-Controlled Key - a classic Insecure Direct Object Reference in which the plugin accepts a client-supplied record identifier (such as a coupon, template, or generated PDF record ID) and performs the requested operation without verifying that the requesting user owns or is authorized for that object. Flexible PDF Coupons is a WordPress plugin published by wpdesk; CPE data identifies the affected product family as cpe:2.3:a:wpdesk:flexible_pdf_coupons:*:*:*:*:*:*:*:*, confirming the vulnerability resides in the plugin rather than WordPress core. The route is typically a plugin AJAX action or REST endpoint reached over HTTP, which explains AV:N and AC:L. The CVSS vector's PR:L reflects that the attacker must hold an authenticated role of at least Contributor, consistent with the description's stated prerequisite; UI:N indicates no victim interaction is needed; C:N/I:L/A:L indicates the attacker can corrupt or disrupt the targeted records but cannot read data across accounts and cannot achieve high impact. A Patchstack advisory tags this as an authentication-bypass-class issue, but the assessed prerequisite remains an existing Contributor-level account - the object reference, not WordPress authentication, is what is being bypassed.
Know when Flexible Pdf Coupons gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Network-reachable IDOR needing a Contributor account (PR:L) with no user interaction; missing ownership check permits low integrity/availability tampering on coupon objects without data disclosure (C:N).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <= 1.14.11 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB