CVE-2026-31919: 
WordPress vulnerability analysis and mitigation

CVE-2026-31919 is a Missing Authorization (Broken Access Control) vulnerability in the Advanced Coupons for WooCommerce Coupons WordPress plugin developed by Josh Kohlbach. It affects all versions up to and including 4.7.1, and was discovered and reported by researcher PPzzAArr on January 7, 2026, with public disclosure on February 6, 2026 via Patchstack. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the appropriate permissions before executing certain privileged actions related to coupon management. An authenticated attacker with low privileges (e.g., Contributor or higher role) can send crafted network requests to access restricted coupon data without proper authorization checks. No complex preconditions are required beyond having a valid low-privileged account on the affected WordPress/WooCommerce site (Patchstack).

Successful exploitation allows authenticated low-privileged users to read sensitive coupon information that should be restricted to higher-privileged roles, impacting confidentiality (rated Low per CVSS). There is no direct integrity or availability impact. The primary business risk involves exposure of coupon configurations, discount logic, and potentially customer-related promotional data, which could be leveraged to abuse WooCommerce store promotions or gain competitive intelligence (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale, though this specific issue is rated low priority with unlikely exploitation impact (Patchstack).

The vendor (Rymera Web Co) released a patched version 4.7.1.1 that resolves this vulnerability. Site administrators should update the Advanced Coupons for WooCommerce Coupons plugin to version 4.7.1.1 or later immediately. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, restricting user registration and limiting Contributor-level accounts on the site can reduce exposure (Patchstack).