This vulnerability in the WebToffee Smart Coupons for WooCommerce plugin (<= 2.2.3) arises from missing authorization checks, leading to incorrect access control. An attacker with low privileges can exploit this issue remotely without user interaction to gain limited access to confidential information. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality impact. No vendor advisory or patch information is provided, and the product is not a cloud service.

The vulnerability allows an attacker with low privileges to bypass authorization controls, potentially exposing limited confidential information. There is no impact on integrity or availability. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for unusual activity related to coupon management. Avoid granting unnecessary privileges to users who can interact with the Smart Coupons plugin.