The Coupon X plugin for WooCommerce versions up to and including 1.3.5 is vulnerable to PHP Object Injection due to unsafe deserialization of untrusted input from post content passed to the capture_email AJAX action. This vulnerability requires authenticated access at Contributor level or above. Although the plugin lacks a known POP chain internally, the presence of other plugins or themes with POP chains could enable an attacker to leverage this injection to delete files, access sensitive data, or execute arbitrary code. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity.

An attacker with Contributor-level or higher privileges can inject PHP objects through deserialization, potentially leading to severe impacts such as arbitrary file deletion, sensitive data exposure, or remote code execution if a POP chain is available via other installed plugins or themes. The vulnerability affects confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor for updates from the plugin vendor. Avoid installing untrusted plugins or themes that could provide POP chains enabling exploitation.