CVE-2026-45438

Executive Summary

CVE-2026-45438 is a Missing Authorization vulnerability in the WebToffee Smart Coupons for WooCommerce WordPress plugin. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized access to sensitive coupon data or functionality. The vulnerability affects all versions prior to 2.3.0. With a CVSS score of 7.5 (High), it poses a significant risk to WooCommerce stores using this plugin. No public proof-of-concept (PoC) or exploit code has been released, and the EPSS score is currently 0.0%, indicating low exploitation activity in the wild. However, due to the nature of the vulnerability and the widespread use of WooCommerce, immediate patching is strongly recommended.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the Smart Coupons for WooCommerce plugin. It is not related to any NPM, PyPI, Go, or Ruby packages. The plugin is distributed via the WordPress plugin repository and directly by WebToffee. Users should verify the integrity of their plugin files and ensure they are sourced from the official repository.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): High – Sensitive coupon data can be exposed.
• Integrity (I): None – No data modification possible.
• Availability (A): None – No denial-of-service impact.

Threat Level: High. The combination of network exploitability, low complexity, and no required privileges makes this a serious threat for any WooCommerce store using the vulnerable plugin.

Deep Dive & Mechanics

The vulnerability resides in the Smart Coupons for WooCommerce plugin’s REST API or AJAX handlers. The plugin fails to properly enforce authorization checks on certain endpoints, allowing unauthenticated users to access or manipulate coupon data. Specifically, the missing authorization occurs in functions that handle coupon creation, retrieval, or application logic.

Root Cause: The plugin uses wp_ajax_* hooks without verifying the user’s capabilities (e.g., manage_woocommerce or edit_shop_coupon). This allows any visitor to trigger these actions if the corresponding nonce is bypassed or not properly validated.

Attack Vector: An attacker can send crafted HTTP requests to the vulnerable endpoints, such as:

• POST /wp-admin/admin-ajax.php?action=smart_coupons_get_coupon
• GET /wp-json/smart-coupons/v1/coupons

Without proper authorization, these endpoints may return sensitive coupon codes, discount amounts, or even allow the creation of new coupons.

Impact: An attacker could:

• Steal valid coupon codes for unauthorized discounts.
• Enumerate all coupons in the store.
• Potentially create new coupons if write access is also missing.

Vulnerable vs. Patched Code

The following example illustrates the missing authorization in the vulnerable version versus the patched version (2.3.0+).

Vulnerable Code (pre-2.3.0):

add_action('wp_ajax_nopriv_smart_coupons_get_coupon', 'smart_coupons_get_coupon_callback');
function smart_coupons_get_coupon_callback() {
    // No capability check
    $coupon_id = intval($_POST['coupon_id']);
    $coupon = new WC_Coupon($coupon_id);
    wp_send_json($coupon->get_data());
}

Patched Code (2.3.0):

add_action('wp_ajax_nopriv_smart_coupons_get_coupon', 'smart_coupons_get_coupon_callback');
function smart_coupons_get_coupon_callback() {
    // Added capability check
    if (!current_user_can('manage_woocommerce')) {
        wp_die('Unauthorized', 403);
    }
    $coupon_id = intval($_POST['coupon_id']);
    $coupon = new WC_Coupon($coupon_id);
    wp_send_json($coupon->get_data());
}

The patched version adds a current_user_can('manage_woocommerce') check, ensuring only authenticated users with the appropriate role can access the endpoint.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with WooCommerce and Smart Coupons for WooCommerce < 2.3.0.
• Network access to the target.

Exploitation Steps:

1. Identify the vulnerable endpoint. Common targets include:
   • /wp-admin/admin-ajax.php?action=smart_coupons_get_coupon
   • /wp-json/smart-coupons/v1/coupons
2. Send a crafted request to enumerate coupons:

   curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
        -d "action=smart_coupons_get_coupon&coupon_id=1"
   

3. If successful, the response will contain coupon data in JSON format.
4. For bulk enumeration, iterate through coupon IDs or use a list endpoint.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection & Response:

• Monitor for unusual requests to admin-ajax.php with action=smart_coupons_* parameters from unauthenticated users.
• Check web server logs for 403 errors on these endpoints (if patched) or successful responses (if vulnerable).
• Use the detection rules provided in the Detection Engineering section.

Hunting Queries:

• Search for smart_coupons in HTTP request URIs.
• Look for JSON responses containing coupon data from unauthenticated sessions.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-admin/admin-ajax.php with action=smart_coupons_get_coupon or similar.
  • Unusual JSON responses containing coupon_code, discount_type, or amount fields.
• File IOCs:
  • Modified plugin files in /wp-content/plugins/smart-coupons-for-woocommerce/.
  • Unexpected log entries in /wp-content/debug.log related to coupon access.
• Behavioral IOCs:
  • Sudden increase in coupon usage from unknown IPs.
  • Creation of new coupons without admin action.

Detection Engineering

YARA Rule

rule detect_smart_coupons_missing_auth {
    meta:
        description = "Detects exploitation attempts of CVE-2026-45438 in Smart Coupons for WooCommerce"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-45438"
    strings:
        $ajax_action = "smart_coupons_get_coupon"
        $wp_ajax = "admin-ajax.php"
        $json_response = /"coupon_code"\s*:\s*"[^"]+"/
    condition:
        $ajax_action and $wp_ajax and #json_response > 0
}

Sigma Rule

title: Smart Coupons for WooCommerce Missing Authorization Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated requests to Smart Coupons AJAX endpoints
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "action=smart_coupons_"
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin actions (if logged in)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-45438 Smart Coupons Missing Authorization Attempt"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=smart_coupons_"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin to version 2.3.0 or later. This is the only official fix.
2. If immediate update is not possible, disable the plugin temporarily.
3. Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=smart_coupons_* from unauthenticated users.

Long-Term Measures:

• Regularly update all WordPress plugins and themes.
• Conduct security audits of custom or third-party plugins.
• Use a security plugin (e.g., Wordfence) to monitor for unauthorized access attempts.
• Implement the principle of least privilege for all WordPress user roles.

Workaround (if patching is delayed):

• Add the following code to your theme's functions.php to block unauthenticated access:

  add_action('init', function() {
      if (!is_user_logged_in() && isset($_REQUEST['action']) && strpos($_REQUEST['action'], 'smart_coupons_') === 0) {
          wp_die('Unauthorized', 403);
      }
  });
  

Valters IT
Securing Digital Frontiers