CVE-2020-36841

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The WooCommerce Smart Coupons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the woocommerce_coupon_admin_init function in versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to send themselves gift certificates of any value, which could be redeemed for products sold on the victim’s storefront.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-285

Affected software

No affected versions have been published.

Timeline

Published
Oct 16, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2020

CVE-2020-368428.8The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on tCVE-2020-368434.3The implementation of EdDSA in EdDSA-Java (aka ed25519-java) through 0.3.0 exhibits signature malleability and does not satisfy the SUF-CMA CVE-2020-368446.1The KnowBe4 Security Awareness Training application before 2020-01-10 allows reflected XSS. The response has a SCRIPT element that sets windCVE-2020-368456.1The KnowBe4 Security Awareness Training application before 2020-01-10 contains a redirect function that does not validate the destination URCVE-2020-368469.8A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library.  Versions of IO::Compress::Brotli prior to 0.007 inCVE-2020-368479.8The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename funcCVE-2020-368487.5The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Sensitive Information ExCVE-2020-368499.8The AIT CSV import/export plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-contenCVE-2020-36857.5Pointer variable which is freed is not cleared can result in memory corruption and leads to denial of service in Snapdragon Auto, SnapdragonCVE-2020-368508.7An information disclosure vulnerability exits in Sitecore JSS React Sample Application 11.0.0 - 14.0.1 that may cause page content intended CVE-2020-368519.5Rob--W cors-anywhere instances configured as an open proxy allow unauthenticated external users to induce the server to make HTTP requests tCVE-2020-368529.1The Custom Searchable Data Entry System plugin for WordPress is vulnerable to unauthenticated database wiping in versions up to, and includi