The wpcoachify Coachify plugin versions up to 1.1.5 contain a CSRF vulnerability that enables attackers to trick authenticated users into executing unwanted actions without their consent. The vulnerability is remotely exploitable without privileges but requires user interaction. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

Successful exploitation could allow attackers to cause limited integrity and availability impacts by forcing users to perform unintended actions within the affected plugin. There is no confidentiality impact reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is available, users should monitor for updates from the vendor. Applying standard CSRF protections or disabling the plugin until a fix is available may reduce risk.