CVE-2020-36841

—

CVSS 3.1

5.3 medium

EPSS

<1%p12

Published

Oct 16, 2024 (Oct 16, 2024)

Modified

Jun 17, 2026

Description

The WooCommerce Smart Coupons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the woocommerce_coupon_admin_init function in versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to send themselves gift certificates of any value, which could be redeemed for products sold on the victim’s storefront.

Ecosystems: WordPress, E-commerce
Weakness: CWE-285
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.