WP Desk tightened access to the template editor in Flexible PDF Coupons, its WooCommerce software for selling and emailing PDF gift cards. Two September releases addressed authorisation controls before Patchstack publicly disclosed a related vulnerability on September 30, 2026. [S01][S02]

The remediation sequence and public download activity

The vendor’s September 16 changelog for version 1.14.11 describes preventing unauthorised template updates. Version 1.14.12, dated September 22, restricted editor access to users with WooCommerce management permissions and corrected Shop Manager access to settings and support. Those dates distinguish remediation from the later public advisory. [S01]

Patchstack identifies versions through 1.14.11 as affected by CVE-2026-62081 and recommends 1.14.12 or later. The CVE record describes an insecure direct object reference requiring Contributor privileges. Patchstack credits researcher Brobicho and records a September 14 report. Its assigned CVSS 3.1 base score is 5.4; that score is a severity assessment, not a count of exploited shops. [S02][S03]

The product places WooCommerce coupon codes into PDF vouchers that merchants can sell and send to recipients. The template editor governs part of that document-issuance workflow. Its control weakness does not by itself establish that an attacker could spend a merchant’s entire gift-card liability. [S01][S03]

The repository’s public series records 484 downloads on September 16 and 648 on September 17. It records 605 on September 22 and 621 on September 23. Those dates coincide with the two vendor releases, but the daily totals do not identify which version was downloaded or why. The complete 21-day series below retains the quieter days as well. [S04]

The data behind the story

Daily repository downloads: WP Desk Flexible PDF Coupons

Official daily counts for September 14-October 4, 2026, spanning the security-remediation and disclosure period. Retrieved October 19.

downloads
Source
WordPress.org official daily plugin-download API, retrieved October19,2026

Repository activity, not unique stores, affected installations, gift-card sales or confirmed security updates. The response does not identify downloaded versions, successful installation or exploitation. Date labels are reproduced as returned; the API does not state a reporting timezone. No missing days are filled.

Show data tableHide data table
Scroll left or right to see all columns
Daily repository downloads: WP Desk Flexible PDF Coupons (downloads)
CategoryRepository-reported downloads
2026-09-1448 downloads
2026-09-1535 downloads
2026-09-16484 downloads
2026-09-17648 downloads
2026-09-18158 downloads
2026-09-1958 downloads
2026-09-2081 downloads
2026-09-21127 downloads
2026-09-22605 downloads
2026-09-23621 downloads
2026-09-24149 downloads
2026-09-2594 downloads
2026-09-2651 downloads
2026-09-2751 downloads
2026-09-28173 downloads
2026-09-2984 downloads
2026-09-3090 downloads
2026-10-01135 downloads
2026-10-0279 downloads
2026-10-0355 downloads
2026-10-0438 downloads

This is a distribution-activity measure, not proof that 648 separate stores installed a fix on September 17, nor a denominator for calculating patch coverage. The API provides neither individual site identifiers nor an installation-success field. It cannot resolve how many affected installations remained exposed. [S04]

The CVE record rates confidentiality impact as none and integrity and availability impact as low. CISA’s September 30 assessment records no exploitation at that assessment time. Neither that finding nor the download series establishes theft of gift-card balances, customer-data exposure or a merchant loss. [S03][S04]

The verified operational change is the restriction on who can modify gift-card templates and access the editor. The available evidence connects that remedy to dated releases and public repository activity, while leaving affected transaction counts and financial consequences unquantified. [S01][S02][S03]