CVE-2026-106028: ActiveTrail WooCommerce Auth Bypass Flaw

CVE-2026-106028 Overview

CVE-2026-106028 affects the ActiveTrail for WooCommerce WordPress plugin through version 1.2.6. The plugin fails to perform authorization checks before creating WooCommerce coupons. Unauthenticated attackers can create arbitrary coupons, including 100%-off and free-shipping coupons, directly against vulnerable stores.

The weakness maps to Missing Authorization [CWE-862]. Any internet-exposed WooCommerce store running the affected plugin can be abused to generate discount codes without credentials. Attackers can then redeem these coupons to obtain goods at no cost or with free shipping, producing direct revenue loss for store operators.

Critical Impact

Unauthenticated attackers can create arbitrary WooCommerce coupons, including 100%-off and free-shipping codes, leading to financial loss for affected merchants.

Affected Products

• ActiveTrail for WooCommerce WordPress plugin, all versions through 1.2.6
• WordPress sites running WooCommerce with the ActiveTrail integration enabled
• E-commerce deployments exposing the plugin's unauthenticated endpoint to the internet

Discovery Timeline

• 2026-10-19 - CVE-2026-106028 published to NVD
• 2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-106028

Vulnerability Analysis

The ActiveTrail for WooCommerce plugin exposes a coupon-creation code path that does not validate the requester's identity or role. The vulnerability is a Broken Access Control issue, specifically Missing Authorization as classified by [CWE-862].

An attacker reaches the vulnerable endpoint over the network without authentication or user interaction. Successful exploitation does not disclose data or impair availability. It allows attackers to inject arbitrary coupon records into the WooCommerce database, which affects integrity of pricing and promotion data.

Because the created coupons can be configured with 100% discount values or free-shipping flags, exploitation translates directly into financial impact when attackers redeem the generated codes at checkout. The attack is scriptable and can be executed at scale against any store running the vulnerable plugin.

Root Cause

The plugin's coupon-creation handler lacks a capability check (for example, current_user_can('manage_woocommerce')) and lacks a nonce verification step. Request handlers that mutate commerce state must enforce both authentication and authorization, and this handler enforces neither.

Attack Vector

Exploitation occurs remotely over HTTP(S) against the WordPress REST or admin-ajax endpoint registered by the plugin. The attacker issues a crafted request specifying coupon parameters such as discount type, amount, and shipping flags. The server processes the request and persists the coupon without validating the caller.

No authenticated session, cookies, or administrative access are required. Technical details are available in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-106028

Indicators of Compromise

• Unexpected coupon entries in the wp_posts table with post_type = 'shop_coupon' that were not created by store administrators
• Coupons configured with discount_type = 'percent' at coupon_amount = 100 or with the free_shipping meta flag enabled
• Orders with abnormally high discount totals redeeming recently created coupons from unknown IP ranges
• HTTP requests to ActiveTrail plugin endpoints originating from unauthenticated sessions

Detection Strategies

• Review WooCommerce coupon audit logs for coupons created outside of normal administrator activity windows
• Correlate web server access logs with coupon creation timestamps to identify unauthenticated POST requests to ActiveTrail endpoints
• Alert on new coupons with 100% discount values or free-shipping flags generated programmatically

Monitoring Recommendations

• Enable WordPress audit logging to track coupon lifecycle events, including creation, modification, and redemption
• Monitor WooCommerce order reports for sudden spikes in fully discounted or free-shipping orders
• Instrument a web application firewall (WAF) to log and rate-limit requests to the plugin's REST routes

How to Mitigate CVE-2026-106028

Immediate Actions Required

• Deactivate the ActiveTrail for WooCommerce plugin until a patched version is confirmed installed
• Audit all existing WooCommerce coupons and disable any that were not created by authorized personnel
• Review recent orders for fraudulent redemption of attacker-created coupons and initiate chargeback or refund reversals where appropriate
• Rotate any administrative credentials if post-exploitation activity is suspected

Patch Information

No fixed version is identified in the available advisory data. The vulnerability affects the plugin through version 1.2.6. Monitor the WPScan Vulnerability Report and the official plugin repository for an updated release that enforces authorization on coupon creation.

Workarounds

• Block external access to the plugin's REST and admin-ajax endpoints at the WAF or reverse proxy layer
• Restrict coupon creation privileges and require manual approval for new coupon codes in business workflows
• Temporarily disable automatic coupon redemption at checkout and require staff validation for high-discount codes

# Example WAF rule concept to block unauthenticated requests to the plugin endpoint
# Replace <plugin-route> with the specific ActiveTrail route observed in access logs
SecRule REQUEST_URI "@contains /wp-json/<plugin-route>/coupon" \
    "id:1060280,phase:1,deny,status:403,log,msg:'Block unauthenticated ActiveTrail coupon creation (CVE-2026-106028)'"