The WP eCommerce WordPress plugin through 3.15.1 does not have CSRF check in place when deleting coupons, which could allow attackers to make a logged in admin remove them via a CSRF attack
CVE-2026-1128
NONE
EPSS 0.01%
Updated Mar 06, 2026
WordPress
CVE Details
CVE ID
CVE-2026-1128
Published Date
Mar 06, 2026
Vendor
WordPress
Severity
NONE
Exploit Prediction (EPSS)
Probability of Exploit
0.01%
Likelihood of exploitation in next 30 days
Percentile:
0.8th percentile (higher than 0.8% of all CVEs)
Standard patching cycle
Impact
Minimal impact
Source
View Advisory