Security Alert Summary
The WP eCommerce plugin contains a vulnerability that lacks a cross-site request forgery (CSRF) check when deleting coupons. An attacker could cause a logged-in administrator to unintentionally delete coupons via a CSRF attack if they are able to trick that administrator into visiting a crafted page or link.
CVE Details
- CVE ID: CVE-2026-1128
- Affected component: WP eCommerce WordPress plugin (deleting coupons)
- Affected versions: through 3.15.1 (as stated in the CVE description)
- Published: March 6, 2026 at 6:15:57 AM UTC
- Last modified: March 6, 2026 at 6:15:57 AM UTC
- CVSS v3.1 base score / severity / vector: Not specified in the CVE entry
- Authentication / privileges / user interaction: The description indicates the attack requires a logged-in administrator to be tricked (CSRF); specific CVSS fields are not provided in the CVE entry.
- Primary impact:
- Confidentiality: No impact specified
- Integrity: Modification or deletion of coupon data (integrity impact)
- Availability: No impact specified
- CWE / weakness ID: Not specified in the CVE entry
Technical Details
According to the CVE description, the WP eCommerce plugin through version 3.15.1 does not implement a CSRF check when processing coupon deletion requests. Because the delete action lacks this protection, an attacker can craft a request that, if loaded by a logged-in administrator, will trigger the coupon deletion action without the administrator’s explicit intent.
The CVE description does not name specific functions, REST API endpoints, or the exact missing checks. The core issue is the absence of a CSRF protection mechanism on the coupon-deletion workflow, which allows state-changing actions to be initiated via cross-site requests.
Impact is limited to the ability to remove coupon records; the report does not state additional impacts such as disclosure of user data or escalation of privileges.
How This Could Impact Your Website
Consider a small team managing an online store: the site owner, an internal content manager with administrative access, and an external marketing contractor who handles promotions. If an attacker convinces the internal administrator to visit a malicious page (for example, via a targeted phishing link), the missing CSRF check could allow coupon entries to be deleted without the administrator’s awareness.
Practical consequences include loss of promotional coupons, disruption of marketing campaigns, and the potential need to recreate coupon codes and associated tracking. While this does not explicitly expose user credentials or site administrative access, it can cause operational friction and may enable follow-on social engineering or targeted phishing if coupon or promotion workflows are relied upon for customer interactions.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. The CVE entry does not specify a fixed version.
- Review and reduce unnecessary user roles, especially users with administrative privileges and contributors who do not need them.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and audit logs for unusual behavior, such as unexpected coupon deletions or changes to promotional settings.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
