What’s Vulnerable › Vulnerabilities

CVE-2020-36834: Discount Rules for WooCommerce <= 2.0.2 - Missing Authorization

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-10-16 · updated 2026-06-17
• Weakness: CWE-862

Description

The Discount Rules for WooCommerce plugin for WordPress is vulnerable to missing authorization via several AJAX actions in versions up to, and including, 2.0.2 due to missing capability checks on various functions. This makes it possible for subscriber-level attackers to execute various actions and perform a wide variety of actions such as modifying rules and saving configurations.

Affected products

• flycart Discount Rules for WooCommerce: through 2.0.2

References

• https://patchstack.com/articles/multiple-vulnerabilities-in-discount-rules-for-woocommerce-plugin/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/33cf27ba-a01b-4e34-9584-b1d3fc87af34?source=cve

Get alerted when CVE-2020-36834 or the next vulnerability affects your stack