The WordPress CouponXxL Theme contains a Cross‑Site Request Forgery vulnerability that enables an attacker to perform privileged actions without authorization. This flaw can lead to unauthorized changes within the theme’s configuration or data, effectively escalating privileges to an administrator level. The weakness is classified as CWE‑352 and results in a high impact on confidentiality, integrity, and availability if exploited.

The affected systems are WordPress sites that use the pebas CouponXxL theme, versions up to and including 4.5.0. All installations of this theme, regardless of WordPress version, are susceptible unless the theme has been updated beyond 4.5.0.

The vulnerability has a CVSS score of 8.8, indicating a high severity. EPSS indicates a very low exploitation probability (<1%), and it is not listed in the CISA KEV catalog. The likely attack vector requires a victim user to be tricked into submitting a forged request while authenticated, or to exploit a logged‑in admin session. If an attacker can get the victim to click a malicious link or load a crafted page, the CSRF payload can be executed and privileges escalated.