Unauthorized Gift Certificate Creation Vulnerability in WooCommerce Smart Coupons

CVE-2020-36841

Summary

The WooCommerce Smart Coupons plugin for WordPress has a vulnerability that allows unauthorized users to exploit a missing capability check within the woocommerce_coupon_admin_init function. This flaw affects versions up to and including 4.6.0, enabling unauthenticated attackers to create gift certificates of arbitrary value. Once generated, these certificates can be redeemed for products in the affected storefront, posing a significant risk to the integrity of online transactions and financial losses for merchants.

References