CVE-2025-8692

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8692", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-06T22:56:09.071Z", "datePublished": "2025-09-11T07:24:53.990Z", "dateUpdated": "2026-04-08T16:53:17.778Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:53:17.778Z"}, "affected": [{"vendor": "kamilkhan", "product": "Coupon API", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.2.12", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Coupon API plugin for WordPress is vulnerable to SQL Injection via the \u2018log_duration\u2019 parameter in all versions up to, and including, 6.2.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "Coupon API <= 6.2.12 - Authenticated (Administrator+) SQL Injection via 'log_duration'", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5443aa7f-e290-4b7f-9be0-23daf1624935?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/couponapi/trunk/views.php#L530"}, {"url": "https://plugins.trac.wordpress.org/browser/couponapi/trunk/views.php#L559"}, {"url": "https://plugins.trac.wordpress.org/browser/couponapi/trunk/views.php#L577"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "timeline": [{"time": "2025-09-10T18:49:37.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-11T14:05:23.477518Z", "id": "CVE-2025-8692", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T14:39:58.483Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8692", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-11T14:05:23.477518Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T14:05:26.160Z"}}], "cna": {"title": "Coupon API <= 6.2.12 - Authenticated (Administrator+) SQL Injection via 'log_duration'", "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "kamilkhan", "product": "Coupon API", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.2.12"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-10T18:49:37.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5443aa7f-e290-4b7f-9be0-23daf1624935?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/couponapi/trunk/views.php#L530"}, {"url": "https://plugins.trac.wordpress.org/browser/couponapi/trunk/views.php#L559"}, {"url": "https://plugins.trac.wordpress.org/browser/couponapi/trunk/views.php#L577"}], "descriptions": [{"lang": "en", "value": "The Coupon API plugin for WordPress is vulnerable to SQL Injection via the \u2018log_duration\u2019 parameter in all versions up to, and including, 6.2.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:53:17.778Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8692", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:53:17.778Z", "dateReserved": "2025-08-06T22:56:09.071Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-11T07:24:53.990Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Coupon API", "vendor": "kamilkhan", "versions": [{"lessThanOrEqual": "6.2.12", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Coupon API plugin for WordPress is vulnerable to SQL Injection via the \u2018log_duration\u2019 parameter in all versions up to, and including, 6.2.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "id": "CVE-2025-8692", "lastModified": "2026-06-17T10:07:26.980", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8692", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-11T14:05:23.477518Z", "version": "2.0.3"}}]}, "published": "2025-09-11T08:15:35.803", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/couponapi/trunk/views.php#L530"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/couponapi/trunk/views.php#L559"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/couponapi/trunk/views.php#L577"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5443aa7f-e290-4b7f-9be0-23daf1624935?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T03:03:03.930654+00:00", "value": {"mitigation_remediation": ["Upgrade the Coupon API plugin to a version newer than 6.2.12 that addresses the SQL injection flaw.", "Restrict the number of users with Administrator privileges or remove the Administrator capability from users who do not need it for coupon management.", "Create a fresh backup of the WordPress database before performing any updates or configuration changes."], "summary": {"action": "Apply Patch", "impact": "SQL Injection allowing data extraction"}, "threat_synthesis": {"affected_systems": "The vulnerability applies to all releases of the Coupon API plugin up to and including version 6.2.12. The affected product is managed by kamilkhan and is used as a WordPress plugin. No further sub\u2011version details are provided. ", "description_and_impact": "A flaw in the Coupon API WordPress plugin permits authenticated administrators to inject arbitrary SQL through the log_duration parameter. The insufficient escaping and lack of prepared statements enable the attacker to append new queries to the existing statement, potentially exposing sensitive database contents. This vulnerability directly affects the confidentiality of data stored in the WordPress database. ", "risk_and_exploitability": "The CVSS score of 4.9 indicates moderate severity and the EPSS score of less than 1% shows a very low current exploitation probability. Because the flaw requires Administrator\u2011level authentication, the attack surface is limited to privileged users, and it is not listed in CISA\u2019s KEV catalog. Exploitation would involve logging in as an administrator, sending a crafted request containing malicious SQL in the log_duration field, and capturing the resulting data leak."}}}}, "created": "2025-09-12T08:03:04.055197+00:00", "updated": "2026-04-21T03:15:16.327263+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}