Flexible Pdf Coupons
Monthly
Authenticated IDOR in the WordPress plugin Flexible PDF Coupons (versions up to and including 1.14.11) lets a Contributor-level account manipulate object identifiers to act on coupon and PDF records it does not own. The vulnerability is network-reachable and low complexity, but requires a valid low-privilege WordPress account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base 5.4), and per the assessed vector the impact is limited to low integrity and availability effects with no confidentiality disclosure. No public exploit identified at time of analysis; there is no CISA KEV listing and no EPSS signal was provided, and no vendor-released patch version was identified in the available data.
Authenticated IDOR in the WordPress plugin Flexible PDF Coupons (versions up to and including 1.14.11) lets a Contributor-level account manipulate object identifiers to act on coupon and PDF records it does not own. The vulnerability is network-reachable and low complexity, but requires a valid low-privilege WordPress account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base 5.4), and per the assessed vector the impact is limited to low integrity and availability effects with no confidentiality disclosure. No public exploit identified at time of analysis; there is no CISA KEV listing and no EPSS signal was provided, and no vendor-released patch version was identified in the available data.