High · published January 7, 2026
⚡ A sneaky gap in the Reviewify plugin lets attackers with just a Contributor role create discount coupons! 💸 Think of it as a restaurant where customers can walk into the kitchen and cook up their own meal specials without the chef’s supervision. This vulnerability allows users with basic access to whip up arbitrary discounts that could hurt your store's budget. An attacker could exploit this flaw to generate unlimited discount coupons, leading to significant financial loss for your WooCommerce store. With malicious coupons in play, your profits could vanish faster than a dessert at a buffet!
Think of it as a restaurant where customers can walk into the kitchen and cook up their own meal specials without the chef’s supervision. This vulnerability allows users with basic access to whip up arbitrary discounts that could hurt your store's budget. The issue arises from a missing capability check in the 'send_test_email' AJAX action of the Reviewify plugin, allowing authenticated users with Contributor-level access or higher to modify data they shouldn't be able to touch.
An attacker could exploit this flaw to generate unlimited discount coupons, leading to significant financial loss for your WooCommerce store. With malicious coupons in play, your profits could vanish faster than a dessert at a buffet! To safeguard your store, update the Reviewify plugin to version 1.0.8 or later immediately. Additionally, review user roles and permissions to limit access and prevent potential exploitation of this vulnerability. You've got this! With these steps, you'll be on your way to reinforcing your store's security. 🛡️