Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2026-1128

WP eCommerce <= 3.15.1 - Coupon Deletion via CSRF

Description

The WP eCommerce WordPress plugin through 3.15.1 does not have CSRF check in place when deleting coupons, which could allow attackers to make a logged in admin remove them via a CSRF attack

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown WP eCommerce

Default version status: unknown

  • 0 to ≤ 3.15.1affected

References