What is CVE-2024-12204?

CVE-2024-12204 is a medium-severity vulnerability in Premio Coupon X – Discount Popups & Promo Codes Pop Ups For Woocommerce, classified under Missing Authorization. CVSS score: 5.4/10. Published 2025-01-11.

How severe is CVE-2024-12204?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Is CVE-2024-12204 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Premio Coupon X – Discount Popups & Promo Codes Pop Ups For Woocommerce

CVE-2024-12204

The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions in the class-cx-rest.php file in all versions up to, and including, 1.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create 100% off coupons, delete posts, delete leads, and update coupon statuses.

Vulnerability class: Broken Access Control

EPSS: 0.002 (15.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.

Affected products

Premio Coupon X – Discount Popups & Promo Codes Pop Ups For Woocommerce — versions 0

Weakness classification (CWE)

CWE-862 — Missing Authorization

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2024-12204?: CVE-2024-12204 is a medium-severity vulnerability in Premio Coupon X – Discount Popups & Promo Codes Pop Ups For Woocommerce, classified under Missing Authorization. CVSS score: 5.4/10. Published 2025-01-11.
How severe is CVE-2024-12204?: Medium severity. CVSS v3 base score is 5.4 out of 10.
Is CVE-2024-12204 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.