This vulnerability involves missing authorization checks in the Coupon Affiliates plugin (<= 7.2.0) by Elliot Sowersby / RelyWP. It allows unauthenticated attackers to access functionality that should be restricted by ACLs, potentially enabling unauthorized modification or manipulation of plugin features. The CVSS v3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No patch or official remediation guidance is currently provided.

The vulnerability allows attackers to access and potentially manipulate functionality within the Coupon Affiliates plugin without proper authorization. This can lead to integrity issues such as unauthorized changes to coupon or affiliate data. There is no impact on confidentiality or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitor for updates from Elliot Sowersby / RelyWP or the plugin distribution channels. Consider restricting access to the plugin's administrative interfaces as a temporary measure if feasible.