The Reviewify plugin for WordPress is vulnerable to unauthorized modification of data, allowing authenticated attackers to create arbitrary discount coupons and potentially cause financial loss.

This is an authorization bypass vulnerability (CWE-862) occurring within the send_test_email AJAX action. The flaw allows authenticated attackers with Contributor-level access or higher to perform unauthorized actions, specifically the creation of WooCommerce discount coupons.

The ability for low-privileged users to generate unauthorized discount coupons poses a direct risk of financial loss to the e-commerce store. Given the CVSS score of 7.5, this high-severity vulnerability could be leveraged to manipulate sales data, erode profit margins, and potentially facilitate fraudulent transactions if left unaddressed.

Immediate Action: Update the Reviewify plugin to the latest available version beyond 1.0.7 immediately to include the required capability checks.

Proactive Monitoring: Monitor WooCommerce coupon creation logs for unusual activity or coupons generated by accounts that do not have administrative privileges.

Compensating Controls: If an update is not immediately feasible, deactivate the Reviewify plugin or restrict access to administrative functions via a Web Application Firewall (WAF) until the patch can be applied.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability presents a significant business risk by enabling unauthorized coupon generation. Administrators should prioritize updating the Reviewify plugin across all affected WordPress installations to ensure proper capability checks are enforced and to prevent potential financial exploitation.