The vulnerability identified as CVE-2026-31919 affects the Advanced Coupons for WooCommerce Coupons plugin by Josh Kohlbach. It is a Missing Authorization issue, meaning that certain actions or resources within the plugin lack proper access control checks. This allows users with limited privileges to potentially perform actions they should not be authorized to do. The affected versions include all versions up to 4.7.1. The CVSS 3.1 base score is 4.3, indicating a medium severity level, with network attack vector, low attack complexity, requiring low privileges, no user interaction, and limited confidentiality impact. No patch or official fix information is available at this time.

The vulnerability could allow an attacker with low privileges to bypass access controls and perform unauthorized actions within the Advanced Coupons for WooCommerce Coupons plugin. The impact is limited to confidentiality loss with no reported integrity or availability impact. There are no known exploits in the wild, and the plugin is not a cloud service, so the vendor does not manage remediation server-side.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin's administrative interfaces and monitor for unusual activity related to coupon management. Avoid granting unnecessary privileges to users who can interact with the plugin.