CVE-2025-54025: Coupon Affiliates Auth Bypass Vulnerability

CVE-2025-54025 Overview

CVE-2025-54025 is a missing authorization vulnerability in the Coupon Affiliates WordPress plugin (woo-coupon-usage) developed by Elliot Sowersby / RelyWP. The flaw affects all plugin versions up to and including 6.4.0. Attackers can exploit incorrectly configured access control security levels to change plugin settings without proper authorization. The vulnerability is remotely exploitable over the network without authentication or user interaction. It is tracked as CWE-862: Missing Authorization and impacts integrity and availability of affected WordPress sites running the plugin.

Critical Impact
Unauthenticated remote attackers can modify plugin settings on any WordPress site running Coupon Affiliates versions through 6.4.0, disrupting coupon and affiliate functionality.

Affected Products

Elliot Sowersby / RelyWP Coupon Affiliates (woo-coupon-usage) plugin
All versions from n/a through 6.4.0
WordPress sites using the plugin with WooCommerce

Discovery Timeline

2025-08-20 - CVE-2025-54025 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54025

Vulnerability Analysis

The vulnerability originates in the Coupon Affiliates plugin's handling of settings-modification requests. The plugin exposes one or more endpoints that change configuration state without verifying whether the requesting user holds the required capability. Because authorization is missing, requests from unauthenticated or low-privilege users are accepted and processed as if they came from an administrator.

The attack vector is the network, complexity is low, and no privileges or user interaction are required. The scope is unchanged, with impact limited to integrity and availability. Confidentiality is not directly affected. An attacker sending crafted HTTP requests to the vulnerable settings handler can alter plugin behavior, disrupt affiliate tracking, and modify coupon configuration. The EPSS probability is 0.253%, placing the CVE around the 16th percentile for likelihood of exploitation.

Root Cause

The root cause is a missing capability check on privileged actions [CWE-862]. WordPress plugins are expected to validate requests using current_user_can() and a nonce check via check_admin_referer() or wp_verify_nonce(). In the affected versions of woo-coupon-usage, at least one settings handler processes user-supplied input without enforcing these checks, allowing state changes from unauthorized contexts.

Attack Vector

An attacker identifies a WordPress site running Coupon Affiliates 6.4.0 or earlier and issues an HTTP POST request to the vulnerable admin-ajax or admin-post endpoint controlling plugin settings. Because no capability check is enforced, the plugin applies the attacker-supplied values. No authenticated session or social engineering is required. Details are available in the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-54025

Indicators of Compromise

Unexpected changes to Coupon Affiliates plugin settings in the WordPress admin panel
HTTP POST requests to wp-admin/admin-ajax.php or wp-admin/admin-post.php referencing woo-coupon-usage actions from unauthenticated sessions
Modifications to coupon or affiliate configuration entries in the wp_options table without a corresponding admin login event
Anomalous affiliate commission or coupon redemption behavior following unexplained setting changes

Detection Strategies

Review web server access logs for POST requests to plugin action handlers lacking a valid authenticated wordpress_logged_in_* cookie
Compare current plugin option values against a known-good baseline using WP-CLI: wp option get for Coupon Affiliates keys
Enable WordPress audit logging to record settings changes with the initiating user and IP address

Monitoring Recommendations

Alert on repeated requests to admin-ajax.php with action parameters tied to woo-coupon-usage from external IPs
Track file integrity of plugin files under wp-content/plugins/woo-coupon-usage/
Forward WordPress and web server logs to a centralized SIEM and correlate settings-change events with request source IPs

How to Mitigate CVE-2025-54025

Immediate Actions Required

Update the Coupon Affiliates plugin to a version later than 6.4.0 as soon as the vendor releases a patched build
Audit the plugin's current settings against a known-good configuration and revert any unauthorized changes
Restrict access to wp-admin/ paths at the web server or WAF layer to trusted IP ranges where feasible
Rotate any API keys, integration tokens, or webhook secrets configured within the plugin

Patch Information

Refer to the Patchstack Vulnerability Report for vendor patch status. Apply the fixed version published by RelyWP once available through the WordPress plugin repository. Verify the installed version by running wp plugin get woo-coupon-usage --field=version after updating.

Workarounds

Deactivate the Coupon Affiliates plugin until a patched version is installed if it is not business-critical
Deploy a Web Application Firewall (WAF) rule to block unauthenticated POST requests targeting woo-coupon-usage action names
Enforce authentication in front of wp-admin/admin-ajax.php for privileged actions through server-level access controls

bash

# Example WAF rule concept and update workflow
wp plugin update woo-coupon-usage
wp plugin get woo-coupon-usage --field=version

# Example nginx rule to block unauthenticated plugin admin actions
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "woo_coupon_usage|wcusage") {
        if ($http_cookie !~* "wordpress_logged_in_") {
            return 403;
        }
    }
}