Description
The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons, allowing unauthenticated attackers to create arbitrary coupons, including 100%-off and free-shipping coupons.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | ActiveTrail for WooCommerce | ≤ 1.2.6 | — |
References
- https://wpscan.com/vulnerability/0865bdd3-8ce9-4a3b-a174-07076dee8565/ exploit vdb-entry technical-description