Canonical URL: https://giftcard.news/fraud-security/wp-desk-flexible-pdf-gift-card-template-access-security-fix/ --- description: September releases restricted the template editor; Patchstack subsequently disclosed CVE-2026-62081 and identified version 1.14.12 as the remedy. title: WP Desk tightens access to PDF gift-card templates after security finding image: https://giftcard.news/images/social/v1/wp-desk-tightens-access-pdf-gift-card-templates-after-security-finding-aad0231ecc39d40644017fdce4c134f5.jpg --- 1. [Home](https://giftcard.news/) 2. [Fraud & Security](https://giftcard.news/fraud-security/) # WP Desk tightens access to PDF gift-card templates after security finding September releases restricted the template editor; Patchstack subsequently disclosed CVE-2026-62081 and identified version 1.14.12 as the remedy. By [Daniel Brooks](https://giftcard.news/author/daniel-brooks/) September 16, 2026 3 min read [ Google News ](https://google.com/preferences/source?q=giftcard.news&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news) Share [ ](https://x.com/intent/post?url=https%3A%2F%2Fgiftcard.news%2Ffraud-security%2Fwp-desk-flexible-pdf-gift-card-template-access-security-fix%2F%3Futm%5Fsource%3Dx%26utm%5Fmedium%3Dsocial&text=WP+Desk+tightens+access+to+PDF+gift-card+templates+after+security+finding&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news "X") [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fgiftcard.news%2Ffraud-security%2Fwp-desk-flexible-pdf-gift-card-template-access-security-fix%2F%3Futm%5Fsource%3Dlinkedin%26utm%5Fmedium%3Dsocial&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news "LinkedIn") [ ](https://wa.me/?text=WP+Desk+tightens+access+to+PDF+gift-card+templates+after+security+finding+https%3A%2F%2Fgiftcard.news%2Ffraud-security%2Fwp-desk-flexible-pdf-gift-card-template-access-security-fix%2F%3Futm%5Fsource%3Dwhatsapp%26utm%5Fmedium%3Dsocial&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news "WhatsApp") ![Flexible PDF Coupons security chronology: September 16 template-update fix, September 22 editor-permission restriction, September 30 CVE-2026-62081 disclosure.](https://giftcard.news/images/variants/v1/wp-desk-tightens-access-pdf-gift-card-templates-after-security-finding-flexible-2-w1280.webp) The vendor’s security-release chronology precedes the public CVE disclosure. Patchstack identifies version 1.14.12 as patched. Photo: Gift Card News; sources: WP Desk and Patchstack [WP Desk](https://giftcard.news/company/wp-desk/) tightened access to the template editor in Flexible PDF Coupons, its WooCommerce software for selling and emailing PDF gift cards. Two September releases addressed authorisation controls before [Patchstack](https://giftcard.news/company/patchstack/) publicly disclosed a related vulnerability on September 30, 2026\. [\[S01\]](#article-source-1)[\[S02\]](#article-source-2) ## The remediation sequence and public download activity The vendor’s September 16 changelog for version 1.14.11 describes preventing unauthorised template updates. Version 1.14.12, dated September 22, restricted editor access to users with WooCommerce management permissions and corrected Shop Manager access to settings and support. Those dates distinguish remediation from the later public advisory. [\[S01\]](#article-source-1) Patchstack identifies versions through 1.14.11 as affected by CVE-2026-62081 and recommends 1.14.12 or later. The CVE record describes an insecure direct object reference requiring Contributor privileges. Patchstack credits researcher Brobicho and records a September 14 report. Its assigned CVSS 3.1 base score is 5.4; that score is a severity assessment, not a count of exploited shops. [\[S02\]](#article-source-2)[\[S03\]](#article-source-3) The product places WooCommerce coupon codes into PDF vouchers that merchants can sell and send to recipients. The template editor governs part of that document-issuance workflow. Its control weakness does not by itself establish that an attacker could spend a merchant’s entire gift-card liability. [\[S01\]](#article-source-1)[\[S03\]](#article-source-3) The repository’s public series records 484 downloads on September 16 and 648 on September 17\. It records 605 on September 22 and 621 on September 23\. Those dates coincide with the two vendor releases, but the daily totals do not identify which version was downloaded or why. The complete 21-day series below retains the quieter days as well. [\[S04\]](#article-source-4) The data behind the story ### Daily repository downloads: WP Desk Flexible PDF Coupons Official daily counts for September 14-October 4, 2026, spanning the security-remediation and disclosure period. Retrieved October 19. Repository-reported downloads downloads Tap or hover for details. All values are also available in the data table. Source WordPress.org official daily plugin-download API, retrieved October19,2026 Repository activity, not unique stores, affected installations, gift-card sales or confirmed security updates. The response does not identify downloaded versions, successful installation or exploitation. Date labels are reproduced as returned; the API does not state a reporting timezone. No missing days are filled. Show data tableHide data table Scroll left or right to see all columns __Daily repository downloads: WP Desk Flexible PDF Coupons (downloads)__ | Category | Repository-reported downloads | | ---------- | ----------------------------- | | 2026-09-14 | 48 downloads | | 2026-09-15 | 35 downloads | | 2026-09-16 | 484 downloads | | 2026-09-17 | 648 downloads | | 2026-09-18 | 158 downloads | | 2026-09-19 | 58 downloads | | 2026-09-20 | 81 downloads | | 2026-09-21 | 127 downloads | | 2026-09-22 | 605 downloads | | 2026-09-23 | 621 downloads | | 2026-09-24 | 149 downloads | | 2026-09-25 | 94 downloads | | 2026-09-26 | 51 downloads | | 2026-09-27 | 51 downloads | | 2026-09-28 | 173 downloads | | 2026-09-29 | 84 downloads | | 2026-09-30 | 90 downloads | | 2026-10-01 | 135 downloads | | 2026-10-02 | 79 downloads | | 2026-10-03 | 55 downloads | | 2026-10-04 | 38 downloads | This is a distribution-activity measure, not proof that 648 separate stores installed a fix on September 17, nor a denominator for calculating patch coverage. The API provides neither individual site identifiers nor an installation-success field. It cannot resolve how many affected installations remained exposed. [\[S04\]](#article-source-4) The CVE record rates confidentiality impact as none and integrity and availability impact as low. CISA’s September 30 assessment records no exploitation at that assessment time. Neither that finding nor the download series establishes theft of gift-card balances, customer-data exposure or a merchant loss. [\[S03\]](#article-source-3)[\[S04\]](#article-source-4) The verified operational change is the restriction on who can modify gift-card templates and access the editor. The available evidence connects that remedy to dated releases and public repository activity, while leaving affected transaction counts and financial consequences unquantified. [\[S01\]](#article-source-1)[\[S02\]](#article-source-2)[\[S03\]](#article-source-3) ## In this article ### Companies * [Patchstack](https://giftcard.news/company/patchstack/) * [WP Desk](https://giftcard.news/company/wp-desk/) ### Sources and documents * [\[S01\] Vendor product description and dated security-release chronology](https://wordpress.org/plugins/flexible-coupons/?utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news) — WP Desk via WordPress.org * [\[S02\] Original September 30 vulnerability disclosure](https://patchstack.com/database/wordpress/plugin/flexible-coupons/vulnerability/wordpress-flexible-pdf-coupons-plugin-1-14-11-insecure-direct-object-references-idor-vulnerability?%5Fs%5Fid=cve&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news) — Patchstack * [\[S03\] Patchstack-assigned CVE record and precise impact metrics](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/62xxx/CVE-2026-62081.json?utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news) — CVE Program / Patchstack * [\[S04\] Original daily repository-download series](https://api.wordpress.org/stats/plugin/1.0/downloads.php?slug=flexible-coupons&limit=60&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news) — WordPress.org Share [ ](https://x.com/intent/post?url=https%3A%2F%2Fgiftcard.news%2Ffraud-security%2Fwp-desk-flexible-pdf-gift-card-template-access-security-fix%2F%3Futm%5Fsource%3Dx%26utm%5Fmedium%3Dsocial&text=WP+Desk+tightens+access+to+PDF+gift-card+templates+after+security+finding&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news "X") [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fgiftcard.news%2Ffraud-security%2Fwp-desk-flexible-pdf-gift-card-template-access-security-fix%2F%3Futm%5Fsource%3Dlinkedin%26utm%5Fmedium%3Dsocial&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news "LinkedIn") [ ](https://wa.me/?text=WP+Desk+tightens+access+to+PDF+gift-card+templates+after+security+finding+https%3A%2F%2Fgiftcard.news%2Ffraud-security%2Fwp-desk-flexible-pdf-gift-card-template-access-security-fix%2F%3Futm%5Fsource%3Dwhatsapp%26utm%5Fmedium%3Dsocial&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news "WhatsApp") ![Portrait of Daniel Brooks](https://giftcard.news/images/variants/v1/daniel-brooks-editorial-portrait-w320.webp) About the author ## [Daniel Brooks](https://giftcard.news/author/daniel-brooks/) Journalist — Payments, Security & PCI DSS Daniel Brooks covers payment networks, financial technology, payment security, gift card fraud and PCI DSS for Gift Card News. From reading to building ## Your next move in gift cards. Tell us what you’re building. We’ll help you explore suitable providers. [Find a provider ](https://giftcard.news/find-a-provider/) ## Related articles [Fraud & Security](https://giftcard.news/fraud-security/) News ### [giftee Group estimates JPY 550 million loss after unauthorized e-gift issuance](https://giftcard.news/fraud-security/giftee-unauthorized-egift-issuance-estimated-loss-2026/) [Daniel Brooks](https://giftcard.news/author/daniel-brooks/) October 26, 2026 3 min [Fraud & Security](https://giftcard.news/fraud-security/) News ### [San Francisco settlement creates $1.525 million Vanilla gift-card fund](https://giftcard.news/fraud-security/san-francisco-vanilla-gift-card-restitution-fund/) [Daniel Brooks](https://giftcard.news/author/daniel-brooks/) October 23, 2026 4 min [Fraud & Security](https://giftcard.news/fraud-security/) News ### [Valuedesign reports card-data leak as MOS resets PINs](https://giftcard.news/fraud-security/valuedesign-value-card-data-leak-mos-card-2026/) [Daniel Brooks](https://giftcard.news/author/daniel-brooks/) October 23, 2026 4 min ```json {"@context":"https://schema.org","@graph":[{"@type":"NewsMediaOrganization","@id":"https://giftcard.news/#publisher","name":"Gift Card News","url":"https://giftcard.news/","description":"News and analysis covering gift cards, retail, loyalty, rewards and payments worldwide.","logo":{"@type":"ImageObject","url":"https://giftcard.news/icon-512.png","contentUrl":"https://giftcard.news/icon-512.png","width":512,"height":512,"@id":"https://giftcard.news/#logo"},"publishingPrinciples":"https://giftcard.news/editorial-policy/","correctionsPolicy":"https://giftcard.news/editorial-policy/"},{"@type":"WebSite","@id":"https://giftcard.news/#website","url":"https://giftcard.news/","name":"Gift Card News","description":"News and analysis covering gift cards, retail, loyalty, rewards and payments worldwide.","inLanguage":"en","publisher":{"@id":"https://giftcard.news/#publisher"},"potentialAction":{"@type":"SearchAction","target":"https://giftcard.news/search/?q={search_term_string}","query-input":"required name=search_term_string"}},{"@type":"Person","@id":"https://giftcard.news/author/daniel-brooks/#person","name":"Daniel Brooks","url":"https://giftcard.news/author/daniel-brooks/","description":"Daniel Brooks covers payment networks, financial technology, payment security, gift card fraud and PCI DSS for Gift Card News.","jobTitle":"Journalist — Payments, Security & PCI DSS","image":{"@type":"ImageObject","url":"https://giftcard.news/images/daniel-brooks-editorial-portrait.webp","contentUrl":"https://giftcard.news/images/daniel-brooks-editorial-portrait.webp","width":1254,"height":1254,"caption":"Illustrated portrait representing the Daniel Brooks editorial profile.","@id":"https://giftcard.news/images/daniel-brooks-editorial-portrait.webp#image","encodingFormat":"image/webp","description":"Illustrated portrait for Daniel Brooks, a Gift Card News editorial pen name","creditText":"Gift Card News / AI-generated illustration"}},{"@type":"ImageObject","url":"https://giftcard.news/images/wp-desk-tightens-access-pdf-gift-card-templates-after-security-finding-flexible-2.webp","contentUrl":"https://giftcard.news/images/wp-desk-tightens-access-pdf-gift-card-templates-after-security-finding-flexible-2.webp","width":1920,"height":1440,"caption":"The vendor’s security-release chronology precedes the public CVE disclosure. Patchstack identifies version 1.14.12 as patched.","@id":"https://giftcard.news/images/wp-desk-tightens-access-pdf-gift-card-templates-after-security-finding-flexible-2.webp#image","encodingFormat":"image/webp","description":"Flexible PDF Coupons security chronology: September 16 template-update fix, September 22 editor-permission restriction, September 30 CVE-2026-62081 disclosure.","creditText":"Gift Card News; sources: WP Desk and Patchstack","isBasedOn":"https://wordpress.org/plugins/flexible-coupons/"},{"@type":"Dataset","@id":"https://giftcard.news/fraud-security/wp-desk-flexible-pdf-gift-card-template-access-security-fix/#dataset","url":"https://giftcard.news/fraud-security/wp-desk-flexible-pdf-gift-card-template-access-security-fix/","name":"WP Desk tightens access to PDF gift-card templates after security finding: figure data","description":"Tabular data for the figures accompanying \"WP Desk tightens access to PDF gift-card templates after security finding\". Sources, units and limitations are documented with each figure.","inLanguage":"en","isPartOf":{"@id":"https://giftcard.news/fraud-security/wp-desk-flexible-pdf-gift-card-template-access-security-fix/#article"},"isAccessibleForFree":false,"hasPart":[{"@id":"https://giftcard.news/fraud-security/wp-desk-flexible-pdf-gift-card-template-access-security-fix/#article-figure-1-dataset"}],"distribution":{"@type":"DataDownload","contentUrl":"https://giftcard.news/download.csv?article=%2Ffraud-security%2Fwp-desk-flexible-pdf-gift-card-template-access-security-fix%2F","encodingFormat":"text/csv","isAccessibleForFree":false}},{"@type":"Dataset","@id":"https://giftcard.news/fraud-security/wp-desk-flexible-pdf-gift-card-template-access-security-fix/#article-figure-1-dataset","url":"https://giftcard.news/fraud-security/wp-desk-flexible-pdf-gift-card-template-access-security-fix/#article-figure-1","name":"Daily repository downloads: WP Desk Flexible PDF Coupons","description":"Tabular values displayed in the figure \"Daily repository downloads: WP Desk Flexible PDF Coupons\" and its accompanying data table.\n\nOfficial daily counts for September 14-October 4, 2026, spanning the security-remediation and disclosure period. Retrieved October 19.\n\nRepository activity, not unique stores, affected installations, gift-card sales or confirmed security updates. The response does not identify downloaded versions, successful installation or exploitation. Date labels are reproduced as returned; the API does not state a reporting timezone. No missing days are filled.","inLanguage":"en","isPartOf":{"@id":"https://giftcard.news/fraud-security/wp-desk-flexible-pdf-gift-card-template-access-security-fix/#dataset"},"isAccessibleForFree":false,"variableMeasured":[{"@type":"PropertyValue","name":"Repository-reported downloads","unitText":"downloads"}],"isBasedOn":[{"@type":"CreativeWork","name":"WordPress.org official daily plugin-download API, retrieved October19,2026","url":"https://api.wordpress.org/stats/plugin/1.0/downloads.php?slug=flexible-coupons&limit=60"}]},{"@type":"NewsArticle","@id":"https://giftcard.news/fraud-security/wp-desk-flexible-pdf-gift-card-template-access-security-fix/#article","url":"https://giftcard.news/fraud-security/wp-desk-flexible-pdf-gift-card-template-access-security-fix/","headline":"WP Desk tightens access to PDF gift-card templates after security finding","description":"September releases restricted the template editor; Patchstack subsequently disclosed CVE-2026-62081 and identified version 1.14.12 as the remedy.","datePublished":"2026-09-16T00:00:00.000Z","dateModified":"2026-10-19T15:37:31.952Z","inLanguage":"en","mainEntityOfPage":{"@id":"https://giftcard.news/fraud-security/wp-desk-flexible-pdf-gift-card-template-access-security-fix/#webpage"},"isPartOf":{"@id":"https://giftcard.news/#website"},"isAccessibleForFree":false,"hasPart":[{"@type":"WebPageElement","isAccessibleForFree":false,"cssSelector":".reader-restricted"},{"@id":"https://giftcard.news/fraud-security/wp-desk-flexible-pdf-gift-card-template-access-security-fix/#dataset"}],"image":[{"@type":"ImageObject","url":"https://giftcard.news/images/wp-desk-tightens-access-pdf-gift-card-templates-after-security-finding-flexible-2.webp","contentUrl":"https://giftcard.news/images/wp-desk-tightens-access-pdf-gift-card-templates-after-security-finding-flexible-2.webp","width":1920,"height":1440,"caption":"The vendor’s security-release chronology precedes the public CVE disclosure. Patchstack identifies version 1.14.12 as patched.","@id":"https://giftcard.news/images/wp-desk-tightens-access-pdf-gift-card-templates-after-security-finding-flexible-2.webp#image","encodingFormat":"image/webp","description":"Flexible PDF Coupons security chronology: September 16 template-update fix, September 22 editor-permission restriction, September 30 CVE-2026-62081 disclosure.","creditText":"Gift Card News; sources: WP Desk and Patchstack","isBasedOn":"https://wordpress.org/plugins/flexible-coupons/"}],"articleSection":"Fraud & Security","keywords":["Patchstack","WP Desk"],"mentions":[{"@type":"Organization","@id":"https://giftcard.news/company/patchstack/#entity","name":"Patchstack","url":"https://giftcard.news/company/patchstack/"},{"@type":"Organization","@id":"https://giftcard.news/company/wp-desk/#entity","name":"WP Desk","url":"https://giftcard.news/company/wp-desk/"}],"wordCount":524,"citation":[{"@type":"CreativeWork","name":"[S01] Vendor product description and dated security-release chronology","url":"https://wordpress.org/plugins/flexible-coupons/","publisher":{"@type":"Organization","name":"WP Desk via WordPress.org"}},{"@type":"CreativeWork","name":"[S02] Original September 30 vulnerability disclosure","url":"https://patchstack.com/database/wordpress/plugin/flexible-coupons/vulnerability/wordpress-flexible-pdf-coupons-plugin-1-14-11-insecure-direct-object-references-idor-vulnerability?_s_id=cve","publisher":{"@type":"Organization","name":"Patchstack"}},{"@type":"CreativeWork","name":"[S03] Patchstack-assigned CVE record and precise impact metrics","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/62xxx/CVE-2026-62081.json","publisher":{"@type":"Organization","name":"CVE Program / Patchstack"}},{"@type":"CreativeWork","name":"[S04] Original daily repository-download series","url":"https://api.wordpress.org/stats/plugin/1.0/downloads.php?slug=flexible-coupons&limit=60","publisher":{"@type":"Organization","name":"WordPress.org"}}],"author":[{"@id":"https://giftcard.news/author/daniel-brooks/#person"}],"publisher":{"@id":"https://giftcard.news/#publisher"}},{"@type":"WebPage","@id":"https://giftcard.news/fraud-security/wp-desk-flexible-pdf-gift-card-template-access-security-fix/#webpage","url":"https://giftcard.news/fraud-security/wp-desk-flexible-pdf-gift-card-template-access-security-fix/","name":"WP Desk tightens access to PDF gift-card templates after security finding","description":"September releases restricted the template editor; Patchstack subsequently disclosed CVE-2026-62081 and identified version 1.14.12 as the remedy.","datePublished":"2026-09-16T00:00:00.000Z","dateModified":"2026-10-19T15:37:31.952Z","inLanguage":"en","isPartOf":{"@id":"https://giftcard.news/#website"},"mainEntity":{"@id":"https://giftcard.news/fraud-security/wp-desk-flexible-pdf-gift-card-template-access-security-fix/#article"},"breadcrumb":{"@id":"https://giftcard.news/fraud-security/wp-desk-flexible-pdf-gift-card-template-access-security-fix/#breadcrumbs"},"primaryImageOfPage":{"@id":"https://giftcard.news/images/wp-desk-tightens-access-pdf-gift-card-templates-after-security-finding-flexible-2.webp#image"}},{"@type":"BreadcrumbList","@id":"https://giftcard.news/fraud-security/wp-desk-flexible-pdf-gift-card-template-access-security-fix/#breadcrumbs","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://giftcard.news/"},{"@type":"ListItem","position":2,"name":"Fraud & Security","item":"https://giftcard.news/fraud-security/"},{"@type":"ListItem","position":3,"name":"WP Desk tightens access to PDF gift-card templates after security finding","item":"https://giftcard.news/fraud-security/wp-desk-flexible-pdf-gift-card-template-access-security-fix/"}]}]} ```