{"id":"CVE-2026-106028","kind":"vulnerability","aliases":["CVE-2026-106028"],"related":[],"title":"ActiveTrail for WooCommerce plugin lets anyone create free WooCommerce coupons","description":"The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons, allowing unauthenticated attackers to create arbitrary coupons, including 100%-off and free-shipping coupons.","summary":"The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 skips its authorization check before creating WooCommerce coupons. An unauthenticated attacker can create arbitrary coupons, including 100% off and free-shipping coupons, and use them to buy goods for free.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `ActiveTrail for WooCommerce` plugin is installed and its version is `1.2.6` or lower, in the WordPress admin under Plugins or in the plugin directory `wp-content/plugins/`.\n- Review recent WooCommerce coupons for unexpected 100% discount or free-shipping entries.","fix":"- Update the ActiveTrail for WooCommerce plugin to a version later than `1.2.6`; the sources do not name the fixed version, so unknown.\n- If no fixed version is available, deactivate and remove the plugin.\n- Delete any unexpected coupons and review orders that used them.","status":"open","published_at":"2026-10-19T06:17:20+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:26:40+00:00","updated_at":"2026-10-25T04:26:40+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:26:40Z","model":"claude-haiku-5-5","output":{"fix":"- Update the ActiveTrail for WooCommerce plugin to a version later than `1.2.6`; the sources do not name the fixed version, so unknown.\n- If no fixed version is available, deactivate and remove the plugin.\n- Delete any unexpected coupons and review orders that used them.","reach":"internet","title":"ActiveTrail for WooCommerce plugin lets anyone create free WooCommerce coupons","impact":"medium","summary":"The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 skips its authorization check before creating WooCommerce coupons. An unauthenticated attacker can create arbitrary coupons, including 100% off and free-shipping coupons, and use them to buy goods for free.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","ecommerce"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker creates free 100% discount coupons and buys goods without paying.","analyst_note":"Confirm the fixed plugin version and which endpoint is missing the check; the NVD entry does not list one.","how_to_check":"- Check whether the `ActiveTrail for WooCommerce` plugin is installed and its version is `1.2.6` or lower, in the WordPress admin under Plugins or in the plugin directory `wp-content/plugins/`.\n- Review recent WooCommerce coupons for unexpected 100% discount or free-shipping entries.","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the ActiveTrail for WooCommerce plugin through version 1.2.6 with WooCommerce enabled are exposed, because the coupon creation endpoint accepts requests without authentication. Sites that do not have this plugin installed are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000665,"input_tokens":3312,"output_tokens":667,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-106028':13A,16A '-2026':12A,15A '1.2.6':28B,67C '100':45B,86C 'activetrail':1A,22B,61C 'allow':78C 'anyon':6A 'arbitrari':42B,83C 'attack':39B,80C 'author':31B,72C 'buy':56B 'check':32B,73C 'coupon':10A,36B,43B,51B,77C,84C,92C 'creat':7A,34B,41B,75C,82C 'cve':11A,14A 'ecommerc':17B 'free':8A,49B,59B,90C 'free-ship':48B,89C 'good':57B 'includ':44B,85C 'let':5A 'packag':18B 'perform':70C 'plugin':4A,26B,65C 'ship':50B,91C 'skip':29B 'unauthent':38B,79C 'use':53B 'woocommerc':3A,9A,19B,24B,35B,63C,76C 'wordpress':20B,25B,64C","nicknames":[],"mitigations":[],"who_affected":"Sites running the ActiveTrail for WooCommerce plugin through version 1.2.6 with WooCommerce enabled are exposed, because the coupon creation endpoint accepts requests without authentication. Sites that do not have this plugin installed are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T06:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106028","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106028","severity":null,"published_at":"2026-10-19T06:17:20+00:00","modified_at":"2026-10-19T21:04:50+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}