CVE-2026-1128 — WP eCommerce <= 3.15.1 - Coupon Deletion via CSRF
The WP eCommerce WordPress plugin through 3.15.1 does not have CSRF check in place when deleting coupons, which could allow attackers to make a logged in admin remove them via a…
Published: 2026-03-06 · CVSS: 4.3 · CVSS 3.1
The WP eCommerce WordPress plugin through 3.15.1 does not have CSRF check in place when deleting coupons, which could allow attackers to make a logged in admin remove them via a CSRF attack
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7