CVE-2026-1128

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The WP eCommerce WordPress plugin through 3.15.1 does not have CSRF check in place when deleting coupons, which could allow attackers to make a logged in admin remove them via a CSRF attack

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

VendorProductVersions
UnknownWP eCommerce<= 3.15.1

References

Timeline

Published
Mar 6, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-112804.3Inappropriate implementation in Signin in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via aCVE-2026-1128007.0Heap-based buffer overflow in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally.CVE-2026-1128017.8Insufficiently protected credentials in Windows eSCL Scanner allows an authorized attacker to elevate privileges locally.CVE-2026-1128027.8Missing authorization in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-1128035.5Improper access control in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally.CVE-2026-1128047.0Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally.CVE-2026-1128058.8Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-1128064.7Insufficiently protected credentials in Windows Print Spooler Components allows an authorized attacker to disclose information locally.CVE-2026-1128076.5Heap-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to deny service over a networCVE-2026-1128086.5Exposure of sensitive system information to an unauthorized control sphere in Windows Print Spooler Components allows an authorized attackerCVE-2026-1128095.5Improper access control in Windows Composite Image File System allows an authorized attacker to disclose information locally.CVE-2026-112815.0Integer overflow in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to obtain potentially sensitive i
CVE-2026-1128: Medium severity, CVSS 4.3 | Vulnix