CVE-2026-106028 ActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation

The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons, allowing unauthenticated attackers to create arbitrary coupons, including 100%-off and free-shipping coupons...

CVE-2026-106028 ActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation

The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons, allowing unauthenticated attackers to create arbitrary coupons, including 100%-off and free-shipping coupons...

WordPress ActiveTrail for WooCommerce plugin <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation vulnerability

Unauthenticated Arbitrary Coupon Creation vulnerability discovered by Ryan Fabella in WordPress Plugin ActiveTrail for WooCommerce versions = 1.2.6...

CVE-2026-106028

The ActiveTrail for WooCommerce WordPress plugin, in versions up to and including 1.2.6 , is vulnerable to an authorization bypass. The plugin fails to perform adequate authorization checks when creating WooCommerce coupons, which allows unauthenticated attackers to create arbitrary coupons. This...

WordPress Tutor LMS - eLearning and online course solution plugin <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modification vulnerability

WordPress Tutor LMS - eLearning and online course solution plugin = 3.9.3 - Missing Authorization to Authenticated Subscriber+ Arbitrary Coupon Modification vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin Tutor LMS versions = 3.9.3...