{"id":"CVE-2026-106028","title":"ActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation","summary":"The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons, allowing unauthenticated attackers to create arbitrary coupons, including 100%-off and free-ship…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvssSource":"adp","cwe":["CWE-862"],"product":"ActiveTrail for WooCommerce","affected":["activetrail_for_woocommerce <= 1.2.6"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-19T09:23:42.414274Z"},"published":"2026-10-19","updated":"2026-10-19","sourceUpdated":"2026-10-19T09:31:20.161Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-106028","references":[{"url":"https://wpscan.com/vulnerability/0865bdd3-8ce9-4a3b-a174-07076dee8565/"}],"tags":["cve.org"],"ingestedAt":"2026-10-19T07:09:59.599Z","epss":0.00146,"epssPercentile":0.03482,"slug":"CVE-2026-106028","body":"## Overview\n\nThe ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons, allowing unauthenticated attackers to create arbitrary coupons, including 100%-off and free-shipping coupons.\n\n## Affected\n\n- `activetrail_for_woocommerce <= 1.2.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":224863,"id":"CVE-2026-106028","ts":1792409219985,"field":"cvss","old":null,"new":"5.3"},{"seq":224862,"id":"CVE-2026-106028","ts":1792409219985,"field":"severity","old":"none","new":"medium"}]}