Known vulnerabilities in Discount Rules for WooCommerce

The discount plugin for WooCommerce helps you create bulk discount, quantity discount, storewide sale, dynamic pricing discount offers easily.

3Reported vulnerabilities

6.3Highest CVSS score

2.6.16Latest version

100,000+Active installs

What to do now

Update Discount Rules for WooCommerce to 2.6.6 or later. 3 of these have a fixed version available. Updating resolves them.

Plugin last updated: May 28, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
WF-ac3a7732-c076-4418-b44a-748cc5668107	Medium 6.3	—	2.2.0 and earlier	`2.2.1`	September 17, 2020
CVE-2020-36834	Medium 6.3	0.4%	2.0.2 and earlier	`2.1.0`	August 20, 2020
CVE-2024-8541	Medium 6.1	0.4%	2.6.5 and earlier	`2.6.6`	October 16, 2024

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.