The vulnerability identified as CVE-2026-25337 is a CSRF issue in the wpcoachify Coachify plugin, affecting versions up to 1.1.5. CSRF vulnerabilities enable attackers to trick authenticated users into submitting unauthorized requests, potentially causing unintended actions. The CVSS vector indicates the attack can be performed remotely over the network with low attack complexity and no privileges required, but user interaction is necessary. The impact includes limited integrity and availability effects, with no confidentiality impact reported.

The vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user, potentially leading to limited integrity and availability impacts within the affected application. There is no indication of confidentiality compromise. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. In the meantime, consider implementing CSRF protections such as verifying request origins and using anti-CSRF tokens if possible.