CVE-2026-1128

The WP eCommerce WordPress plugin (versions 3.15.1 and earlier ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a missing CSRF check when performing coupon deletions. An attacker can leverage this flaw to trick a logged-in administrator into removing coupons withou...