Is CVE-2026-112285 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112285 being exploited in the wild.

How severe is CVE-2026-112285?

Medium severity, with a CVSS score of 4.3, published 19 October 2026.

Which products and versions are affected?

Thelia before 3.1.5, 3.2.x before 3.2.4.

Is there a fix for CVE-2026-112285?

Yes: fixed in Thelia 3.1.5, 3.2.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-112285 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-112285?

Check whether you run Thelia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112285: Thelia coupon usage limit bypass

CVE-2026-112285 · Severity: medium · CVSS 4.3 · Published 2026-10-19

Thelia is an e-commerce platform that manages online stores including coupon/discount codes. This vulnerability allows authenticated customers to bypass coupon usage limits by exploiting how the system counts coupon uses—only when orders are paid. Attackers can place multiple unpaid orders to use the same coupon repeatedly, or cancel paid orders to reset usage counters, gaining unlimited discounts.

Technologies: Thelia. Vendors: Thelia.

Quick answers

Is CVE-2026-112285 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112285 being exploited in the wild.
How severe is CVE-2026-112285?: Medium severity, with a CVSS score of 4.3, published 19 October 2026.
Which products and versions are affected?: Thelia before 3.1.5, 3.2.x before 3.2.4.
Is there a fix for CVE-2026-112285?: Yes: fixed in Thelia 3.1.5, 3.2.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112285 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-112285?: Check whether you run Thelia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Thelia 3.1.5, 3.2.4

Technical details

A business logic vulnerability in Thelia's coupon usage tracking counts usage only after an order is paid, not when it is placed. Authenticated attackers can place multiple pay-later orders while a coupon remains available, or cancel paid orders to increment the max_usage counter. No special privileges or network-level access required beyond a customer account.

Affected products

Thelia Thelia before 3.1.5, 3.2.x before 3.2.4

Timeline

2026-10-19: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.