CVE-2026-112839
Deferred Deferred - Pending Action

Missing Authorization in VillaTheme Customer Coupons for WooCommerce

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: Patchstack

Description
Missing Authorization vulnerability in VillaTheme Customer Coupons for WooCommerce woo-customer-coupons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Customer Coupons for WooCommerce: from n/a through 1.3.14.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-112839
EUVD
EUVD-2026-110045

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
VillaTheme Customer Coupons for WooCommerce 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Missing Authorization vulnerability in the VillaTheme Customer Coupons for WooCommerce plugin. It allows users with low privileges, like Subscribers, to access restricted pages or perform actions they shouldn't be able to. The issue exists in versions up to 1.3.14.

Detection Guidance

To detect this vulnerability, check the installed version of the Customer Coupons for WooCommerce plugin. If it is version 1.3.14 or earlier, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files in the /wp-content/plugins/ directory.

Impact Analysis

An attacker with limited access could view sensitive data belonging to other users. This might include personal information or coupons tied to other accounts. The impact is limited but could lead to privacy breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, which may violate GDPR's data protection requirements. For HIPAA, exposure of sensitive user data could result in compliance violations if the plugin handles protected health information.

Mitigation Strategies

Immediately update the Customer Coupons for WooCommerce plugin to version 1.3.15 or later. If updating is not possible, disable the plugin temporarily or restrict access to sensitive pages. Enable auto-updates for the plugin if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112839. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart