CVE-2026-106028: ActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation

Q: Who can exploit this issue?

Any unauthenticated remote attacker can exploit it. No account, privileges, or user interaction are required.

Q: What impact can successful exploitation have?

An attacker can create arbitrary WooCommerce coupons, including coupons for 100% discounts or free shipping. This could allow unauthorized discounted or free orders where the created coupons can be redeemed.

Q: Which installations are affected?

ActiveTrail for WooCommerce versions through 1.2.6 are affected. The available information does not state whether any particular configuration is required.

Published Oct 19, 2026

Updated

The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons, allowing unauthenticated attackers to create arbitrary coupons, including 100%-off and free-shipping coupons.

Affected Software

1 affected component

ActiveTrail ActiveTrail for WooCommerce<=1.2.6

Event History

Oct 19, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated remote attacker can exploit it. No account, privileges, or user interaction are required.

What impact can successful exploitation have?

An attacker can create arbitrary WooCommerce coupons, including coupons for 100% discounts or free shipping. This could allow unauthorized discounted or free orders where the created coupons can be redeemed.

Which installations are affected?

ActiveTrail for WooCommerce versions through 1.2.6 are affected. The available information does not state whether any particular configuration is required.

CVE-2026-106028: ActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What impact can successful exploitation have?

Which installations are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What impact can successful exploitation have?

Which installations are affected?