Live › vulnerability › CVE-2026-106028
Go to dashboardThe ActiveTrail for WooCommerce WordPress plugin through 1.2.6 skips its authorization check before creating WooCommerce coupons. An unauthenticated attacker can create arbitrary coupons, including 100% off and free-shipping coupons, and use them to buy goods for free.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the ActiveTrail for WooCommerce plugin through version 1.2.6 with WooCommerce enabled are exposed, because the coupon creation endpoint accepts requests without authentication. Sites that do not have this plugin installed are not affected.
No product ranges from the sources yet.
ActiveTrail for WooCommerce plugin is installed and its version is 1.2.6 or lower, in the WordPress admin under Plugins or in the plugin directory wp-content/plugins/.1.2.6; the sources do not name the fixed version, so unknown.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons, allowing unauthenticated attackers to create arbitrary coupons, including 100%-off and free-shipping coupons.
This page as .md · .json · in your agent: get_signal("CVE-2026-106028")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.