CVE-2026-49068: 
WordPress vulnerability analysis and mitigation

CVE-2026-49068 is a Sensitive Data Exposure vulnerability in the Coupon Affiliates WordPress plugin (also known as woo-coupon-usage) developed by RelyWP (Elliot Sowersby). It affects all versions up to and including 7.8.1, allowing unauthenticated network attackers to access sensitive subscriber data without any user interaction. The vulnerability was reported by researcher Stefano on May 29, 2026, and publicly disclosed on June 15, 2026. It carries a CVSS v3.1 base score of 7.5 (High), assigned by Patchstack (Patchstack, Github Advisory).

The vulnerability is classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), indicating that the plugin fails to properly restrict access to sensitive subscriber-level data from unauthorized actors (Patchstack). The attack vector is network-based, requires no authentication, no privileges, and no user interaction, making it trivially automatable at scale. According to CISA's SSVC assessment, the vulnerability is classified as automatable with partial technical impact (Github Advisory). Patchstack notes that due to the specific nature of this vulnerability, no virtual patch can be assigned, making direct plugin updates the only remediation path.

Successful exploitation allows an unauthenticated remote attacker to access sensitive subscriber data that should be restricted to authorized users, resulting in a high confidentiality impact with no effect on integrity or availability. Exposed data may include subscriber personal information managed through the Coupon Affiliates plugin, which could be leveraged for phishing, credential stuffing, or further targeted attacks. The vulnerability's automatable nature makes it suitable for mass-exploitation campaigns targeting WordPress sites regardless of their size or traffic (Patchstack).

The vendor RelyWP has released version 7.8.2 of the Coupon Affiliates plugin, which resolves this vulnerability. All users running version 7.8.1 or earlier should update immediately via the WordPress plugin dashboard or by downloading the patched version from the WordPress plugin repository (Patchstack). Patchstack notes that no virtual patch workaround is available for this specific vulnerability, making the plugin update the only effective mitigation. Site administrators should also audit subscriber data access logs to identify any unauthorized access that may have occurred prior to patching.

Wordfence included this vulnerability in their weekly WordPress vulnerability report covering June 8–14, 2026, highlighting it as part of broader WordPress plugin security tracking (Wordfence). Patchstack, the assigning CNA, flagged it as a medium-priority vulnerability with a note that it is expected to be used in mass-exploit campaigns due to its unauthenticated, automatable nature (Patchstack). No significant broader media coverage or notable researcher commentary beyond standard vulnerability database entries has been observed.