Scratch & Win WordPress Plugin Missing Authorization Vulnerability Allows Unauthenticated Coupon Creation

A vulnerability exists in the Scratch & Win – Giveaways and Contests plugin for WordPress, in versions through 2.8.0. The issue arises from a lack of proper capability checks in the apmswn_create_discount() function, allowing unauthenticated users to create coupons. This unauthorized access could be exploited to generate discount codes without any verification or authentication.

Impact

Exploitation of this vulnerability allows for unauthorized coupon creation, which could be misused to apply discounts or promotions without proper authorization.

Reproduction

The vulnerability can be reproduced by sending a POST request to the WordPress site's REST API endpoint '/wp-json/swinwoo/v1/createCouponSWIN' without authentication. The request must include the 'cpn_type', 'swin_code', 'cpn_value', 'free_ship', 'min_order', and 'cpn_descp' parameters. The absence of a capability check in the 'apmswn_create_discount()' function allows this action to be performed by unauthenticated users.

Remediation

Users are advised to update the Scratch & Win – Giveaways and Contests plugin to version 2.9.0 or later.