The WP eCommerce WordPress plugin through version 3.15.1 does not validate a CSRF token when an administrator requests the deletion of a coupon. An attacker who can trick an authenticated admin into visiting a crafted link can cause the admin to delete coupons, resulting in the loss of discount data. This vulnerability is a classic Cross‑Site Request Forgery and therefore falls under CWE‑352.

It affects the WP eCommerce plugin by the vendor Unknown: WP eCommerce, any installation running version 3.15.1 or older. The plugin is used within a WordPress environment, so sites that rely on coupons for sales are impacted.

The vulnerability has a CVSS score of 4.3, indicating moderate severity, and an EPSS score of less than 1 %, showing very low current exploitation probability. It is not listed in CISA’s KEV catalog. Exploitation requires a logged‑in administrator and a successful CSRF request, typically through social engineering or a malicious link. Because of the limited likelihood and the lack of active exploitation, the risk to most installations is low, but the potential impact on coupon availability is significant. Prompt patching is recommended.