CVE-2026-31919: Advanced Coupons Auth Bypass Vulnerability

CVE-2026-31919 Overview

CVE-2026-31919 is a Missing Authorization vulnerability [CWE-862] in the Advanced Coupons for WooCommerce Coupons plugin by Josh Kohlbach. The flaw affects the advanced-coupons-for-woocommerce-free plugin in all versions up to and including 4.7.1. The vulnerability stems from incorrectly configured access control security levels, allowing authenticated users with low privileges to access functionality that should require higher authorization. Successful exploitation results in unauthorized disclosure of limited confidential information from the affected WordPress installation.

Critical Impact
Authenticated low-privilege attackers can bypass access controls in the Advanced Coupons plugin to access restricted plugin functionality, leading to confidentiality impact on WordPress sites running versions ≤ 4.7.1.

Affected Products

Josh Kohlbach Advanced Coupons for WooCommerce Coupons (advanced-coupons-for-woocommerce-free)
All plugin versions from initial release through 4.7.1
WordPress sites with WooCommerce that have this plugin installed and activated

Discovery Timeline

2026-03-13 - CVE-2026-31919 published to NVD
2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-31919

Vulnerability Analysis

The vulnerability is classified under [CWE-862] Missing Authorization. The plugin exposes one or more functions or endpoints without proper capability checks. WordPress plugins typically enforce access using current_user_can() checks or nonce validation tied to user roles. Advanced Coupons for WooCommerce Coupons fails to enforce these checks on at least one privileged code path.

An attacker authenticated to the WordPress instance with low privileges, such as a subscriber or customer role, can invoke functionality intended for shop managers or administrators. The attack vector is network-based and requires no user interaction. The impact is limited to confidentiality, with no direct integrity or availability consequences according to the published CVSS vector.

Root Cause

The root cause is incorrectly configured access control security levels within the plugin. Specific plugin actions, AJAX endpoints, or REST routes do not validate the caller's WordPress role or capability before executing. This omission allows any logged-in user session to trigger sensitive operations.

Attack Vector

Exploitation requires a valid authenticated WordPress account on a target site running the affected plugin. The attacker sends crafted HTTP requests to vulnerable plugin endpoints. Because the endpoints lack authorization gating, the server processes the requests and returns data that should be restricted to higher-privileged roles. Refer to the Patchstack Vulnerability Report for endpoint-specific technical details.

Detection Methods for CVE-2026-31919

Indicators of Compromise

Unusual HTTP POST or GET requests to admin-ajax.php or plugin-specific REST endpoints originating from low-privilege user sessions
Repeated requests to Advanced Coupons plugin actions from subscriber or customer accounts
Web server access logs showing successful 200 responses to plugin endpoints from non-admin authenticated sessions

Detection Strategies

Review WordPress access logs for requests targeting advanced-coupons-for-woocommerce-free plugin paths from accounts without shop-manager or administrator roles
Enable WordPress audit logging plugins to record privileged action invocations correlated with user role at request time
Monitor for anomalous spikes in authenticated requests to plugin AJAX or REST endpoints

Monitoring Recommendations

Track WordPress user activity by role and alert when low-privilege users invoke administrative plugin endpoints
Forward web server and PHP error logs to a centralized SIEM for correlation across the WordPress estate
Establish a baseline for legitimate plugin endpoint traffic and alert on deviations

How to Mitigate CVE-2026-31919

Immediate Actions Required

Identify all WordPress sites running Advanced Coupons for WooCommerce Coupons version 4.7.1 or earlier
Update the plugin to a fixed version once the vendor publishes a patched release beyond 4.7.1
Audit existing WordPress user accounts and remove unnecessary low-privilege accounts that could be used to authenticate and exploit the flaw
Enforce strong password policies and multi-factor authentication for all WordPress user roles

Patch Information

The vulnerability affects versions through 4.7.1. Site administrators should consult the Patchstack Vulnerability Report and the WordPress plugin repository for the latest patched release and upgrade guidance.

Workarounds

Temporarily deactivate the Advanced Coupons for WooCommerce Coupons plugin if a patched version is not yet available and the functionality is non-essential
Restrict access to /wp-admin/admin-ajax.php and plugin REST routes via web application firewall (WAF) rules that enforce role-based access
Disable open registration on the WordPress site to reduce the pool of low-privilege accounts available to attackers
Apply virtual patching rules from a managed WAF provider until the official fix is deployed

bash

# Configuration example: disable open WordPress registration via wp-cli
wp option update users_can_register 0

# Deactivate the vulnerable plugin until patched
wp plugin deactivate advanced-coupons-for-woocommerce-free