CVE-2025-8692

Name of the Vulnerable Software and Affected Versions Coupon API versions prior to 6.2.13

Description An issue exists where authenticated attackers with Administrator-level access and above can perform SQL Injection. This occurs due to insufficient escaping of the user-supplied log duration parameter and a lack of sufficient preparation on the existing SQL query, allowing the addition of malicious SQL queries to extract sensitive information from the database.

Recommendations Update the plugin to a version newer than 6.2.12. Avoid using the log duration parameter until the update is applied.