This vulnerability in the Couponer for Elementor plugin arises from missing authorization checks, which means that users with some level of privileges (PR:L) can perform actions without proper access control enforcement. The CVSS 3.1 score of 5.4 reflects a network attack vector with low attack complexity, no user interaction required, and impacts on integrity and availability but not confidentiality. The affected versions include all versions up to 1.1.7. No patch or vendor advisory is currently provided, and the plugin is not a cloud service, so remediation depends on vendor updates.

The vulnerability allows attackers with limited privileges to bypass authorization controls, potentially leading to unauthorized modifications or disruptions within the Couponer for Elementor plugin. This can affect the integrity and availability of the affected system components but does not compromise confidentiality. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, users should monitor for updates from merkulove and apply any released patches promptly. Until then, restrict access to trusted users only and review plugin usage to minimize exposure.