CVE-2025-54022: 
WordPress vulnerability analysis and mitigation

CVE-2025-54022 is a Cross-Site Request Forgery (CSRF) vulnerability in the Coupon Affiliates WordPress plugin (also known as woo-coupon-usage) developed by Elliot Sowersby / RelyWP. It affects all versions up to and including 6.4.0, and was reported on May 26, 2025, with public disclosure on July 16, 2025. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium/High) (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and arises from insufficient or missing CSRF token validation on one or more plugin actions within the Coupon Affiliates plugin. An unauthenticated attacker can craft a malicious web page or link that, when visited by an authenticated WordPress administrator or privileged user, causes the victim's browser to submit unauthorized requests to the WordPress site on their behalf. No authentication is required on the attacker's side; however, successful exploitation depends on a privileged user interacting with the attacker-controlled content (Patchstack).

Successful exploitation allows a malicious actor to force higher-privileged users (such as site administrators) to execute unwanted actions within the Coupon Affiliates plugin under their current authentication context. This could result in unauthorized modification of affiliate program settings, coupon configurations, or other plugin-managed data, impacting the integrity and availability of the WooCommerce affiliate system. The CVSS vector indicates no direct confidentiality impact but a high availability impact, suggesting certain actions could disrupt plugin functionality (Patchstack, Red Hat CVE).

There is no known public proof-of-concept exploit code or evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.034%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority, noting it is unlikely to be exploited despite CSRF vulnerabilities of this type sometimes being used in mass-exploit campaigns targeting WordPress sites (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Coupon Affiliates plugin version ≤ 6.4.0 using tools like WPScan or by inspecting publicly accessible plugin metadata.
2. Identify target action: Determine which plugin endpoint or admin action lacks CSRF protection (e.g., a form submission or AJAX action within the Coupon Affiliates admin panel).
3. Craft malicious request: Create an HTML page or form that automatically submits a forged HTTP request to the target WordPress site's vulnerable plugin endpoint, mimicking a legitimate admin action (e.g., modifying affiliate settings or deleting data).
4. Deliver to victim: Trick an authenticated administrator into visiting the malicious page via phishing email, social engineering, or embedding the payload in a comment or external site.
5. Action executed: The victim's browser sends the forged request with their active session cookies, causing the WordPress site to execute the unauthorized action under the administrator's privileges (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to Coupon Affiliates admin endpoints (e.g., wp-admin/admin-ajax.php or plugin-specific admin pages) from unusual referrer URLs or external domains.
• Application: Unexplained changes to affiliate program settings, coupon configurations, or commission structures in the Coupon Affiliates plugin dashboard.
• Network: Requests to WordPress admin endpoints originating from non-administrative IP addresses or with referrer headers pointing to external or unknown domains.

The vendor has released version 6.4.1 of the Coupon Affiliates plugin, which patches this vulnerability. Site administrators should update the plugin to version 6.4.1 or later immediately via the WordPress plugin dashboard. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. No configuration-based workaround is available; updating is the only recommended remediation (Patchstack).

The vulnerability was discovered by security researcher lucky_buddy and reported through Patchstack's Active Vulnerability Disclosure Program (VDP) on May 26, 2025. Patchstack classified it as low priority with no impactful threat, and issued early warnings to its customers before public disclosure on July 16, 2025. No significant broader media coverage or notable social media commentary has been observed (Patchstack).