CVE-2025-59567
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Coupon Affiliates plugin up to version 6.8.0 contains a Missing Authorization vulnerability. This allows exploiting incorrectly configured access control security levels.
Risk Assessment
Unauthorized users may gain access to functions or data they should not have access to, potentially leading to confidentiality or integrity breaches.
Recommendation
Update the Coupon Affiliates plugin to the latest version that includes a security fix, and review the permission configuration.
Other vulnerabilities in Coupon Affiliates
See all- CVE-2026-49068High
Coupon Affiliates versions up to 7.8.1 have a vulnerability that allows the exposure of subscriber sensitive data.
- CVE-2026-40770High
Versions of Coupon Affiliates <= 7.5.3 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
- CVE-2025-62884Medium
The Coupon Affiliates plugin up to version 7.2.0 has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. This enables unauthorized use of features.
Original NVD description (English source)
Missing Authorization vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coupon Affiliates: from n/a through <= 6.8.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS