Authorization Bypass Flaw in ActiveTrail for WooCommerce by WordPress
CVE-2026-106028

Currently unrated

Key Information:

Vendor

WordPress
Status
Activetrail For WooCommerce
Vendor
CVE Published:
19 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-106028?

The ActiveTrail for WooCommerce plugin, up to version 1.2.6, contains a significant vulnerability that permits unauthorized users to generate WooCommerce coupons without any prior authentication. This flaw enables an attacker to create various types of coupons, including full discount offers and free shipping codes, which could lead to potential financial exploitation and undermine the security of WooCommerce integrations.

Affected Version(s)

ActiveTrail for WooCommerce 0 <= 1.2.6

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-106028 - Proof of Concept

References

https://wpscan.com/vulnerability/0865bdd3-8ce9-4a3b-a174-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ryan Fabella
WPScan
.