---
id: "CVE-2026-106028"
kind: "vulnerability"
aliases: ["CVE-2026-106028"]
title: "ActiveTrail for WooCommerce plugin lets anyone create free WooCommerce coupons"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ecommerce", "package", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-19T06:17:20+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T04:26:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106028", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# ActiveTrail for WooCommerce plugin lets anyone create free WooCommerce coupons

The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 skips its authorization check before creating WooCommerce coupons. An unauthenticated attacker can create arbitrary coupons, including 100% off and free-shipping coupons, and use them to buy goods for free.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the `ActiveTrail for WooCommerce` plugin is installed and its version is `1.2.6` or lower, in the WordPress admin under Plugins or in the plugin directory `wp-content/plugins/`.
- Review recent WooCommerce coupons for unexpected 100% discount or free-shipping entries.

## Fix

- Update the ActiveTrail for WooCommerce plugin to a version later than `1.2.6`; the sources do not name the fixed version, so unknown.
- If no fixed version is available, deactivate and remove the plugin.
- Delete any unexpected coupons and review orders that used them.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106028

## From the sources

The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons, allowing unauthenticated attackers to create arbitrary coupons, including 100%-off and free-shipping coupons.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_