CVE-2026-1128 identifies a Cross-Site Request Forgery (CSRF) vulnerability in the WP eCommerce plugin for WordPress, affecting all versions through 3.15.1. The vulnerability arises because the plugin does not implement CSRF protections when deleting coupons, specifically lacking nonce verification or other anti-CSRF tokens. This flaw enables an attacker to craft a malicious web request that, when visited by a logged-in WordPress administrator, triggers the deletion of coupons without the admin's explicit consent or knowledge. Since coupons often represent discounts or promotional offers, unauthorized deletion can disrupt business promotions, cause financial loss, or undermine customer trust. The attack requires the victim to be authenticated with administrative privileges and to interact with a malicious webpage or link, as no automated or unauthenticated exploitation is possible. No public exploits have been reported yet, and no official patches are currently linked, indicating the need for urgent attention from site administrators. The vulnerability is classified under CWE-352, highlighting the absence of CSRF protections in the affected functionality. The lack of a CVSS score necessitates an independent severity assessment based on impact and exploitability factors.

The primary impact of this vulnerability is on the integrity and availability of coupon data within WP eCommerce-powered websites. Unauthorized deletion of coupons can disrupt marketing campaigns, cause revenue loss, and damage customer relationships. Since the attack requires administrative privileges, the scope is limited to sites where attackers can lure admins into visiting malicious content. However, given the widespread use of WordPress and e-commerce plugins, the potential reach is significant. The vulnerability does not directly compromise confidentiality or system-wide availability but can indirectly affect business operations and trust. Organizations relying heavily on WP eCommerce for sales and promotions may experience operational disruptions and financial impact. Additionally, repeated exploitation could lead to administrative overhead and increased support costs.

Until an official patch is released, administrators should implement manual mitigations such as restricting admin access to trusted networks or VPNs to reduce exposure. Employ web application firewalls (WAFs) with custom rules to detect and block suspicious coupon deletion requests lacking valid nonces or CSRF tokens. Site owners can also audit and modify the plugin code to add nonce verification for coupon deletion actions, ensuring that each request is validated against a unique token tied to the user session. Educate administrators about the risks of clicking unknown links while logged in to the WordPress admin panel. Regularly back up coupon data and site configurations to enable quick restoration if unauthorized deletions occur. Monitor logs for unusual coupon deletion activity to detect potential exploitation attempts early. Finally, stay alert for official patches or updates from the WP eCommerce development team and apply them promptly.