Cross‑Site Request Forgery (CWE‑352) in the WordPress Vite Coupon plugin allows a remote attacker to remotely execute arbitrary code on the vulnerable site. The flaw enables an adversary to submit a crafted request that the plugin blindly accepts, which can lead to full control of the server and data. The vulnerability is severe, reflected in a CVSS score of 9.6, indicating high damage potential and requires urgent attention.

The issue affects the Vite Coupon plugin by appsbd, versions from the earliest available up to and including 1.0.9. Sites running any of those releases are susceptible if the plugin is active and a user with sufficient privileges is logged in.

The EPSS score is reported as less than 1 %, indicating that publicly known exploitation attempts are rare at present. The vulnerability is not listed in CISA’s KEV catalog, suggesting that no widespread publicly documented exploits exist yet. The likely attack vector is a CSRF attack triggered by a malicious web page or link that a logged‑in administrator visits, enabling the attacker to trigger arbitrary code execution on the site.