Threat Investigation
Request a demo

CVE-2020-36841

Medium

Description

The WooCommerce Smart Coupons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the woocommerce_coupon_admin_init function in versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to send themselves gift certificates of any value, which could be redeemed for products sold on the victim’s storefront.

SeverityMedium
CVSS5.3
Exploit probability—
ProductWooCommerce Smart Coupons
PublishedOct 16, 2024
First seenOct 16, 2024
Weakness typeCWE-285CWE-285

How to fix

Update
  • WooCommerce WooCommerce Smart Coupons4.6.5 or later

Affected products

ProductAffected versionsFixed in
WooCommerce WooCommerce Smart Couponsv < 4.6.54.6.5

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.