Activetrail For Woocommerce
Monthly
Unauthenticated coupon creation in the ActiveTrail for WooCommerce WordPress plugin (all versions through 1.2.6) lets remote attackers mint arbitrary WooCommerce coupons, including 100%-off and free-shipping codes, without any credentials or user interaction. The defect is a missing authorization check on the plugin's coupon-generation routine (CWE-862), so any visitor who can reach the endpoint can write coupon data into the store; the assessed vector (AV:N/AC:L/PR:N/UI:N, I:L only) confirms default installs are reachable over the network while impact stays confined to integrity of discount data rather than data disclosure or site takeover. Publicly available exploit code exists and the finding is documented by WPScan and EUVD-2026-104082, but there is no CISA KEV entry - the practical threat is financially motivated coupon and discount fraud, not mass site compromise; no vendor-released patch is identified in the available data.
Unauthenticated coupon creation in the ActiveTrail for WooCommerce WordPress plugin (all versions through 1.2.6) lets remote attackers mint arbitrary WooCommerce coupons, including 100%-off and free-shipping codes, without any credentials or user interaction. The defect is a missing authorization check on the plugin's coupon-generation routine (CWE-862), so any visitor who can reach the endpoint can write coupon data into the store; the assessed vector (AV:N/AC:L/PR:N/UI:N, I:L only) confirms default installs are reachable over the network while impact stays confined to integrity of discount data rather than data disclosure or site takeover. Publicly available exploit code exists and the finding is documented by WPScan and EUVD-2026-104082, but there is no CISA KEV entry - the practical threat is financially motivated coupon and discount fraud, not mass site compromise; no vendor-released patch is identified in the available data.