CVE-2020-36751 in Coupon Creator Plugin
Summary
by MITRE • 10/25/2023
The Coupon Creator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1. This is due to missing or incorrect nonce validation on the save_meta() function. This makes it possible for unauthenticated attackers to save meta fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/10/2026
The vulnerability identified as CVE-2020-36751 affects the Coupon Creator plugin for WordPress, specifically targeting versions up to and including 3.1. This represents a critical security flaw that undermines the integrity of the plugin's administrative functions. The issue stems from inadequate security controls within the plugin's codebase, creating an exploitable condition that can be leveraged by malicious actors to manipulate the system's metadata storage capabilities. The vulnerability exists within the save_meta() function where proper nonce validation is either missing or incorrectly implemented, leaving the system susceptible to unauthorized modifications.
Cross-site request forgery vulnerabilities fall under the CWE-352 category, which specifically addresses the lack of proper validation of requests originating from authorized users. This particular flaw allows unauthenticated attackers to craft malicious requests that can be executed within the context of an authenticated administrator session. The attack vector relies on social engineering techniques where an attacker must trick a legitimate administrator into performing an action such as clicking on a malicious link or visiting a compromised website. The exploitation process requires the attacker to have knowledge of the specific meta field parameters that can be manipulated through the save_meta() function.
The operational impact of this vulnerability is significant as it provides attackers with the ability to modify critical metadata within the WordPress environment. This can lead to various malicious outcomes including the injection of malicious code, modification of coupon parameters, alteration of promotional content, or potentially even the creation of backdoor access points within the system. The consequences extend beyond simple data manipulation as the compromised administrative functions can be used to establish persistent access or to disrupt normal business operations. The vulnerability's impact is amplified because it affects the core functionality of coupon management, which is often critical for e-commerce operations and marketing campaigns.
Mitigation strategies for this vulnerability should focus on immediate remediation through plugin updates to versions that address the nonce validation issue. Administrators should implement additional security measures such as enabling two-factor authentication, restricting administrative access through IP whitelisting, and monitoring for unusual administrative activities. The principle of least privilege should be enforced by ensuring that only necessary personnel have administrative access to the WordPress installation. Security monitoring should include detection of unauthorized meta field modifications and suspicious administrative actions. Organizations should also consider implementing web application firewalls to help detect and block malicious requests attempting to exploit this vulnerability. Regular security audits and vulnerability assessments should be conducted to identify similar issues in other plugins and themes. The ATT&CK framework categorizes this vulnerability under the T1213 technique for Data from Information Repositories, as it provides unauthorized access to system metadata that can be used for further exploitation or data manipulation.