WordPress Coachify theme 1.1.5 and earlier suffer a Cross‑Site Request Forgery flaw that permits an attacker to trick an authenticated user’s browser into sending malicious requests to the site. By exploiting this weakness, the attacker can trigger any operation that the logged‑in user is authorized to perform, potentially modifying or deleting content, changing settings, or executing other privileged actions. The vulnerability is an instance of the injected request forgery weakness in CWE‑352.

All installations of the WordPress Coachify theme with a version of 1.1.5 or older, including any sites that have not applied the latest patch or rolled over to a newer theme release. The known vendor identifier for the affected product is wpcoachify and the product name is Coachify.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score of less than 1 % suggests that exploitation is currently uncommon but still possible. The issue is not listed in CISA’s KEV catalog, implying no large‑scale exploit activity has been recorded. Attackers can exploit the flaw by persuading a logged‑in user to visit a crafted link or submit a crafted form; the victim’s browser would then send authenticated requests to the WordPress site, potentially executing unintended actions without further authentication steps.