CVE-2023-52190 is a high severity (7.5 CVSS) sensitive information exposure in the Coupon Referral Program plugin for WordPress, in versions through 1.7.2. It can be triggered without logging in. Patchstack lists 1.8.5 as the patched release, so update to 1.8.5 or later.
What's affected
The NVD record covers Coupon Referral Program from WP Swings, versions through 1.7.2, and describes exposure of sensitive information to an unauthorized actor. The weakness is CWE-200 (Exposure of Sensitive Information). Patchstack describes the exposure as unauthenticated coupon and personal data exposure, according to the title of the Patchstack advisory.
The sources disagree on the range. The NVD description says the issue affects Coupon Referral Program through 1.7.2, while Patchstack lists versions through 1.8.4 as vulnerable and 1.8.5 as patched. Go by the Patchstack range: if you run anything below 1.8.5, update. Patchstack also rates this one high priority and has a mitigation rule for it.
How to check if you're exposed
On a site you manage, list installed plugins and their versions with wp-cli:
wp plugin list --fields=name,version,update_version,status
wp plugin get coupon-referral-program --field=version
The slug coupon-referral-program comes from the Patchstack advisory address, so confirm it matches the folder under wp-content/plugins on your site. A version of 1.7.2 or lower is in the affected range. The Plugins screen in the dashboard shows the same version number.
Then check what the plugin stores about coupons and referrals, and who could read it through the site. Check your own site only.
What to do now
- Back up the site.
- Update Coupon Referral Program to 1.8.5 or later, from the dashboard or with
wp plugin update coupon-referral-program. - Review the coupon and customer data the plugin holds, and decide whether affected customers need notice under your own obligations.
- Rotate any codes or credentials that could be abused if they were seen.
- Add a rule at your web server or host to deny direct access to files you do not intend to serve.
Why it matters
An information exposure bug lets the wrong person read data that the site should have kept private. It does not change anything on the site, so it can go unnoticed. Here the record says no login is needed, which widens the audience to anyone who can reach the site.
Patchstack's wording points to personal data as well as coupon data, so a privacy review belongs on the checklist next to the update. The KEV flag in the record is false, and none of the sources we read claim exploitation in the wild.
For a wider view of your own code, the free in-browser dependency scan and the Gold directory show which packages carry known CVEs, and reachability analysis helps you decide which findings to fix first. WordPress plugins installed from the admin screen do not sit in a manifest, so start with the wp-cli inventory above for those.
Quick check
Does updating remove the data that was already exposed?
No. The update closes the hole. Data that was readable before the update may have been seen, so review it and rotate secrets.
Do I need to tell anyone?
That depends on what was exposed and on your legal duties. Work out what the plugin held, then involve whoever owns privacy and compliance for the site.
Sources
Last reviewed: 19 October 2026.
