WordPress Plugin Vulnerabilities

Flexible PDF Coupons – Gift Cards & Vouchers for WooCommerce < 1.14.12 - Authenticated (Contributor+) Insecure Direct Object Reference

Description

The Flexible PDF Coupons – Gift Cards & Vouchers for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.14.11. This is due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
flexible-coupons
Fixed in 1.14.12

References

CVE
CVE-2026-62081
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/bc1e657e-b35e-481e-9eb0-1ff6207f682c

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
2.7 (Low)

Miscellaneous

Original Researcher
Brobicho
Verified
No
WPVDB ID
b88f6f21-663c-4773-a216-1485ceae847b

Timeline

Publicly Published
2026-09-30 (about 17 days ago)
Added
2026-09-30 (about 16 days ago)
Last Updated
2026-09-30 (about 16 days ago)

Other

Published
Title
Published
2025-01-31
Title
WP Job Portal < 2.2.7 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Company Deletion
Published
2026-07-02
Title
MotoPress Appointment Booking < 2.4.5 - Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameter
Published
2026-04-20
Title
EventPrime – Events Calendar, Bookings and Tickets < 4.3.0.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-06-08
Title
6Storage Rentals < 2.27.0 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Disclosure and Modification via 'userId' Parameter
Published
2023-06-19
Title
EventON < 2.1.2 - Unauthenticated Post Access via IDOR