CVE-2026-62081

Executive Summary

CVE-2026-62081 is an Insecure Direct Object Reference (IDOR) vulnerability in the WordPress plugin Flexible PDF Coupons, affecting all versions up to and including 1.14.11. The flaw is classified under CWE-639 (Authorization Bypass Through User-Controlled Key) and allows an authenticated attacker with low privileges to manipulate object identifiers to access or alter coupon resources they do not own. With a CVSS base score of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), the impact is limited to low integrity and availability effects, but it remains remotely exploitable without user interaction, and no official patch currently exists.

Technical Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR), catalogued as CWE-639 — Authorization Bypass Through User-Controlled Key. In this class of flaw, an application exposes a reference to an internal object (such as a coupon record identifier, post ID, or order reference) and relies on that client-supplied reference to locate the object without verifying that the requesting user is authorized to access the specific object. Because the object key is user-controlled, an attacker can substitute a different, valid identifier to reach resources belonging to other users.

The affected component is the Flexible PDF Coupons plugin, a WordPress plugin that generates and manages PDF coupons. Versions <= 1.14.11 are affected. The exact function, hook, parameter, or endpoint name that carries the object reference is not disclosed in the available NVD description, so this report deliberately avoids attributing the flaw to any specific named implementation artifact. What can be stated from the vulnerability class is the mechanism: an authenticated request handler accepts a coupon/object identifier from the request and performs the database read (or write) based solely on that identifier, without an ownership or capability check tied to the authenticated principal.

Key technical characteristics derivable from the provided data:

• Attack vector: Network (AV:N). The vulnerable component is reachable over HTTP/HTTPS through the web application, consistent with a WordPress plugin exposed to remote requests.
• Privileges required: Low (PR:L). The attacker must be an authenticated user — typically any registered WordPress account with subscriber-level or equivalent low privileges — but does not need administrative rights.
• User interaction: None (UI:N). No victim action (such as clicking a crafted link while logged in) is required for the attacker to exercise the flaw.
• Scope: Unchanged (S:U). Exploitation does not, per the CVSS assessment, cross a security authority boundary; impact is confined to the vulnerable component's resources.
• Confidentiality impact: None (C:N) per the assigned vector, indicating the assessed primary effect is not a bulk data disclosure.
• Integrity impact: Low (I:L). The attacker can cause unauthorized modification of coupon-related objects.
• Availability impact: Low (A:L). There is a limited degradation of availability, consistent with tampering that affects a subset of objects.

The combination of CWE-639 and the above subscores describes a horizontal or vertical authorization-bypass condition where an authenticated low-privilege user references coupon objects by identifier and, because ownership validation is absent or insufficient, is able to read or manipulate objects outside their authorized set. The "Contirubor Insecure Direct Object References (IDOR)" phrasing in the NVD entry ties the flaw directly to an object-reference handling defect.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-62081 as of this report (POC_STATUS: None). The following attack chain is therefore inferred at the vulnerability-class level from the CWE-639 classification and the NVD description; it does not rely on any fabricated function, parameter, or endpoint names.

1. Reconnaissance and target identification. The attacker identifies WordPress sites running the Flexible PDF Coupons plugin at a version <= 1.14.11. Plugin presence can be fingerprinted via publicly served plugin assets (for example, files under the plugin's public directory) and version banners, or through internet-wide scanning services. Because the vulnerability requires authentication, the attacker first obtains or registers a valid low-privilege account on the target site — a common capability on sites that permit open registration, or achievable via any previously obtained standard user credentials.

2. Triggering the IDOR. Once authenticated with low privileges, the attacker interacts with the plugin's coupon-handling functionality. In an IDOR the request includes an object reference (an identifier for a coupon or related record). The attacker observes the reference value in requests they are legitimately authorized to make, then substitutes alternative, valid identifier values — enumerating neighboring or otherwise predictable values — to reference coupon objects that belong to other users or to administrative scopes.

3. Execution method at the vulnerability-class level. The manipulation is a direct object-reference substitution: the attacker changes the identifier in the request so that the server resolves it to a different object. Because the vulnerable version fails to verify that the authenticated principal owns or is authorized for the referenced object, the server processes the request as if it were legitimate. No injection payload, code execution primitive, or memory-corruption technique is involved; the attack is purely an authorization-logic bypass using a user-controlled key.

4. Post-exploitation impact. Per the CVSS vector, the successful attacker achieves low integrity and low availability impact: unauthorized modification or disruption of coupon objects that should not be within their control. There is no assessed confidentiality impact in the assigned vector, so the primary observed effect is tampering with coupon data rather than bulk disclosure. Depending on how coupons are consumed downstream, tampering could affect discount/coupon issuance integrity, but no further impact is asserted beyond the CVSS subscores.

Because this CVE is unpatched, an attacker does not need to bypass any fix; the vulnerable behavior is present in every version up to and including 1.14.11.

Impact Assessment

Business impact is moderate. The defect is remotely reachable and does not require user interaction, but it is gated behind authentication (PR:L) and the assessed impact is limited to low integrity and low availability with no confidentiality impact. This places the vulnerability in the medium severity band (CVSS 5.4).

Affected systems: WordPress installations running the Flexible PDF Coupons plugin at version <= 1.14.11. The affected surface is the plugin's coupon-management functionality as exposed to authenticated users.

Blast radius considerations:

• Integrity (Low): Unauthorized modification of coupon objects can undermine the trustworthiness of coupon data within the plugin. An attacker cannot, per the vector, modify arbitrary unrelated application data.
• Availability (Low): The availability subscore indicates a bounded disruptive effect on the targeted objects rather than a full denial of service.
• Confidentiality (None): The assigned vector records no confidentiality impact, which constrains the assessment — this is not characterized here as a mass data-exfiltration issue.

Aggravating factors: the vulnerability is currently unpatched (patch confidence 0/4; no vendor fix, no workaround, and no affected-version mapping supplied by tracked sources). Any site that exposes registration to untrusted parties lowers the barrier, since a low-privilege account is the only prerequisite. Sites that treat coupons as financial instruments or authorization tokens for discounts could experience downstream business-logic consequences beyond the narrowly scored technical impact.

CISA KEV status is NO, and no known threat-actor campaign or in-the-wild exploitation evidence is provided. EPSs has not yet been scored by FIRST.org, so no likelihood estimate should be assumed.

Detection Guidance

Detection for an IDOR is inherently challenging because the malicious requests look structurally like legitimate requests. Effective detection combines authorization-failure telemetry, abnormal enumeration patterns, and access to objects outside the requesting principal's normal object set. The rules below are heuristic and must be tuned to the target environment; they target the vulnerability class and the plugin context rather than any named parameter (none is disclosed).

Sigma Rule

title: Potential IDOR Object Enumeration Against Flexible PDF Coupons
id: 9f3c1a2e-7b44-4d6e-9c1f-2a5b8e0d4c17
status: experimental
description: Detects sequential or high-volume access to coupon/PDF objects by an authenticated low-privilege user, indicative of IDOR enumeration in Flexible PDF Coupons <= 1.14.11 (CVE-2026-62081).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-62081
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_plugin:
    cs-uri-query|contains:
      - 'flexible-pdf-coupons'
      - 'coupon'
  selection_id:
    cs-uri-query|re: '(?i)(id|pid|post|coupon_id|cid)=\d+'
  filter_static:
    cs-uri-stem|endswith:
      - '.css'
      - '.js'
      - '.png'
      - '.jpg'
  condition: selection_plugin and selection_id and not filter_static
fields:
  - c-ip
  - cs-username
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate bulk coupon administration by authorized staff
  - Automated reporting or export jobs
level: medium

YARA Rule

rule CVE_2026_62081_Flexible_PDF_Coupons_IDOR
{
    meta:
        description = "Heuristic detection of Flexible PDF Coupons IDOR (CVE-2026-62081) indicators in plugin source or web logs; targets missing ownership checks on user-controlled coupon identifiers."
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-62081"
        cve = "CVE-2026-62081"
        severity = "medium"
        date = "2026-01-01"

    strings:
        $plugin = "flexible-pdf-coupons" ascii nocase
        $cve    = "CVE-2026-62081" ascii nocase
        $idor_a = "flexible_pdf_coupons" ascii nocase
        $cookie = "wordpress_logged_in" ascii nocase
        $req    = "coupon" ascii nocase

    condition:
        uint16(0) == 0x0A0D or
        ( ($plugin or $idor_a) and ($cookie or $req) ) or
        $cve
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-62081 Possible Flexible PDF Coupons IDOR Object Enumeration"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"coupon"; nocase; http.uri; pcre:"/(?:id|pid|post|coupon_id|cid)=\d{1,6}/i"; http.header; content:"Cookie"; nocase; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-recon; reference:cve,2026-62081; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-62081; sid:6208101; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [any where event.category == "web" and
      wildcard(url.query, "*coupon*") and
      wildcard(url.query, "*id=*") and
      http.request.method == "GET"]
  [any where event.category == "web" and
      wildcard(url.query, "*coupon*") and
      wildcard(url.query, "*id=*") and
      http.response.status_code == 200]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri_query_lower = lower(uri_query)
| where (like(uri_path, "%flexible-pdf-coupons%") OR like(uri_query_lower, "%coupon%"))
| where match(uri_query_lower, "(id|pid|post|coupon_id|cid)=\d+")
| where status=200
| stats count AS req_count, dc(uri_query) AS distinct_refs, values(uri_query) AS sample_refs
        by src_ip, user
| where req_count >= 20 AND distinct_refs >= 10
| sort - req_count
| table src_ip, user, req_count, distinct_refs, sample_refs

Wazuh OSSEC Rule

<group name="web,appsec,CVE-2026-62081,">
  <rule id="620810" level="6">
    <decoded_as>web-accesslog</decoded_as>
    <url>flexible-pdf-coupons|/coupon</url>
    <description>CVE-2026-62081: Access to Flexible PDF Coupons coupon resource - possible IDOR activity.</description>
    <group>cve_2026_62081,idor,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="620811" level="10" frequency="20" timeframe="60">
    <if_matched_sid>620810</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-62081: High-frequency coupon object access from single source - probable IDOR enumeration.</description>
    <group>cve_2026_62081,idor,enumeration,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version mapping beyond "<= 1.14.11" is available.

1. Immediate mitigations.

• Because no patch exists, treat containment as the primary control. Restrict who can register or hold an authenticated account on WordPress sites running Flexible PDF Coupons <= 1.14.11; disabling open registration removes the PR:L foothold that the attacker needs.
• Deactivate or remove the Flexible PDF Coupons plugin on installations where coupon functionality is not business-critical, eliminating the exposed attack surface.
• If the plugin must remain active, place the WordPress administration and any coupon-facing functionality behind additional access controls (reverse-proxy authorization, IP allowlisting, or a WAF).
• Deploy a WAF/virtual patch that enforces per-user authorization on requests carrying coupon/object identifiers, since the application itself does not. Monitor and alert on the enumeration patterns described in the Detection Guidance section.
• Apply least-privilege: audit registered users and reduce role assignments so that no unnecessary accounts hold authenticated access.

2. Patch/upgrade steps.

• There is currently no fixed version to upgrade to; version 1.14.11 and all earlier releases remain affected. Subscribe to the plugin's official channel and to NVD for a version bump that addresses CVE-2026-62081.
• When a patched release is published, update the plugin through the standard WordPress mechanism (or replace it in the plugins directory), verify the new version, and confirm the fix with an authorization test.
• Do not rely on unofficial or third-party patches; validate any fix against the vendor's advisory.

3. Long-term hardening.

• Adopt a plugin vulnerability management process: inventory third-party plugins, continuously map installed versions against CVE feeds, and treat unpatched plugins as risk-bearing components.
• Enforce server-side authorization checks (object-ownership and capability checks) as a development standard for any custom or third-party code that resolves user-supplied object references.
• Maintain monitoring for IDOR-class enumeration (sequential identifier access, access-frequency anomalies) so that authorization-logic flaws are detectable even when no signature is available.
• Keep WordPress core, plugins, and themes current, and remove abandoned or single-maintainer plugins that lack a timely security-response track record.

References

• NVD — CVE-2026-62081: https://nvd.nist.gov/vuln/detail/CVE-2026-62081
• MITRE CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS — Not yet scored for CVE-2026-62081 (no value available at time of writing): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-62081 not listed (KEV: NO): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat-actor campaign or exploit-in-the-wild evidence is associated with CVE-2026-62081 in the provided data. No public proof-of-concept, Nuclei template, or exploit code is known to exist.