The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress suffers from missing authorization checks (CWE-862) in the class-cx-rest.php file in all versions up to 1.3.5. This flaw enables authenticated users with low privileges (Subscriber-level and above) to execute unauthorized operations such as creating free coupons, deleting content, and modifying coupon statuses. The CVSS 3.1 base score is 5.4 (medium), reflecting network attack vector, low attack complexity, and low privileges required without user interaction. No patch or vendor advisory detailing remediation is currently available.

An attacker with Subscriber-level access can exploit this vulnerability to create free coupons, delete posts and leads, and update coupon statuses without proper authorization. This can lead to unauthorized discounts, data loss, and manipulation of promotional content within the WooCommerce environment. The impact is limited to confidentiality and integrity with no direct availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and monitor for suspicious activity related to coupon creation and content deletion. Avoid granting unnecessary privileges to low-level users in the affected plugin environment.