# How I was able to get subscription of $120/year For Free

WeTransfer's education coupon API returned the generated coupon code in the HTTP response, letting anyone claim a free $120/year Plus subscription.

- Payout: $589 (paid EUR 500)
- Severity: medium
- Program: WeTransfer
- Credited: Muhammad Khizer Javed
- Disclosed: 2018-05-18
- Write-up quality: 6/10
- Original: https://blog.securitybreached.org/2018/05/18/get-subscription-of-120-year-for-free-bug-bounty-poc
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-securitybreached-org-2018-05-18-get-subscription-of-120-year-for-free-bug-bounty-poc
- Tags: domain:web impact:integrity kind:bounty platform:blog sev:medium tech:rest technique:source-review vuln:business-logic vuln:fee-bypass vuln:info-disclosure

**Target:** POST /api/ui/education/coupons and POST /api/ui/users
**Root cause:** The coupon-generation endpoint returned the generated coupon code directly in the JSON response instead of only emailing it, and the signup endpoint accepted an arbitrary coupon_code field without verifying email ownership.
**Steps:**
1. POST /api/ui/education/coupons with `{"email":"testttsttststst7@mail.edu"}`
2. Observe response `{"code":"9e0bca0a6d92"}` leaking the coupon
3. Go to https://wetransfer.com/plus, choose Annual subscription, fill details
4. Intercept POST /api/ui/users and add `"coupon_code":"5a9fa8cc51c3"` to the JSON body
5. Forward; response shows `order_completed.free: true` and redirect to payment/completed
**How found:** After failing to tamper with payment amounts, author searched for promos, found the student .edu free-Plus offer, and inspected the coupon request/response — noticing the response body contained a code that should only have been emailed.
**Exploitation:** Attacker submits any .edu email to the coupon endpoint, reads the leaked code from the response, then injects that code as coupon_code in the account-creation request to obtain a free annual Plus subscription without paying.
**Insight:** When a flow claims 'we'll email you a code/link', always inspect the API response body — the secret is often returned client-side anyway; then hunt for the hidden field (coupon_code) that consumes it in a later request.