CVE-2026-106028: ActiveTrail for WooCommerce 0 through 1.2.6

Affected technology

ActiveTrail for WooCommerce · 0 through 1.2.6
Vendor not specified by the source

Description’s affected range: through 1.2.6 does not perform any authorization check before creating WooCommerce coupons

Component: Not specified by the source

What an attacker can do

Unauthenticated attackers can create arbitrary coupons, including 100%-off and free-shipping coupons.