CVE-2025-62884
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The Coupon Affiliates plugin up to version 7.2.0 has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. This enables unauthorized use of features.
Risk Assessment
The organization may face unauthorized access to plugin functionality, potentially leading to data breaches or unauthorized actions.
Recommendation
Update the plugin to the latest version and verify ACL settings.
Other vulnerabilities in Coupon Affiliates
See all- CVE-2026-49068High
Coupon Affiliates versions up to 7.8.1 have a vulnerability that allows the exposure of subscriber sensitive data.
- CVE-2026-40770High
Versions of Coupon Affiliates <= 7.5.3 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
Original NVD description (English source)
Missing Authorization vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Coupon Affiliates: from n/a through <= 7.2.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS