A hacker can brute force the coupon code field value by trying all combinations of alphanumeric values of a certain length (usually 4 to 10 characters). Easier said than done, this technique is possible but strongly depends on the hacker's available processing power.