CVE-2026-25337: Coachify WordPress Plugin CSRF Vulnerability

CVE-2026-25337 Overview

CVE-2026-25337 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Coachify WordPress theme by wpcoachify. The flaw impacts all versions of Coachify up to and including 1.1.5. An attacker can trick an authenticated user into submitting a forged request that performs state-changing actions in the theme without the victim's consent. The vulnerability is tracked under CWE-352 and was published to the National Vulnerability Database (NVD) on 2026-02-19.

Critical Impact
Successful exploitation requires user interaction but enables unauthorized state changes within the Coachify theme, with limited impact to integrity and availability.

Affected Products

Coachify WordPress theme by wpcoachify
All versions from initial release through 1.1.5
WordPress sites using the affected theme

Discovery Timeline

2026-02-19 - CVE-2026-25337 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-25337

Vulnerability Analysis

The vulnerability resides in the Coachify WordPress theme and stems from missing or insufficient CSRF protections on one or more state-changing request handlers. WordPress provides anti-CSRF nonces through functions such as wp_nonce_field() and check_admin_referer(), but the affected handlers in Coachify do not validate them correctly. As a result, an authenticated administrator or privileged user who visits an attacker-controlled page can be made to submit a forged request against their own WordPress site.

The attack is network-based and requires user interaction, but no authentication or privileges on the attacker's side. The scope remains unchanged, and the impact is limited to integrity and availability with no direct confidentiality loss. The Exploit Prediction Scoring System (EPSS) places this issue in the low-probability range, reflecting limited active exploitation interest.

Root Cause

The root cause is improper request validation. The vulnerable code path accepts requests without verifying a valid WordPress nonce or equivalent anti-CSRF token. Without this check, the browser of an authenticated user automatically attaches session cookies to requests originating from any third-party origin, allowing forged actions to succeed.

Attack Vector

An attacker hosts a crafted page containing a hidden form or JavaScript payload that submits a request to the vulnerable Coachify endpoint. When a logged-in WordPress user visits the page, their browser issues the request with valid authentication cookies. The Coachify handler processes the request as legitimate and applies the attacker-controlled changes.

No verified public proof-of-concept code is available. See the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-25337

Indicators of Compromise

Unexpected configuration changes within the Coachify theme settings made without a corresponding admin session.
Web server access logs showing POST requests to Coachify endpoints with Referer headers pointing to external, untrusted domains.
WordPress audit logs showing state changes that do not match known administrator activity windows.

Detection Strategies

Inspect HTTP request logs for state-changing requests to Coachify theme handlers that lack a valid _wpnonce parameter.
Correlate WordPress user session activity with originating Referer and Origin headers to identify cross-origin submissions.
Use a web application firewall (WAF) rule set that flags POST requests missing CSRF tokens to known theme administration paths.

Monitoring Recommendations

Enable WordPress audit logging for theme and option changes, and forward events to a centralized log platform for review.
Monitor for outbound links in user-generated content or email that point to suspicious pages targeting site administrators.
Track administrator browser activity patterns to identify deviations consistent with social-engineering driven CSRF attacks.

How to Mitigate CVE-2026-25337

Immediate Actions Required

Update the Coachify theme to a version newer than 1.1.5 once the vendor publishes a fix.
Restrict administrator accounts to dedicated browser sessions and avoid browsing untrusted sites while authenticated to WordPress.
Enforce least privilege for WordPress roles to limit the scope of any forged action.

Patch Information

At the time of publication, the vulnerability affects Coachify versions up to and including 1.1.5. Site operators should consult the Patchstack WordPress Vulnerability Report and the vendor's distribution channel for an updated release that adds nonce validation to the affected handlers.

Workarounds

Deploy a WAF rule that blocks POST requests to Coachify theme endpoints when the Origin or Referer header is missing or external.
Use a virtual patching plugin such as Patchstack to apply mitigations until an official theme update is available.
Temporarily deactivate the Coachify theme on sites that do not require its functionality.

bash

# Example WAF rule (ModSecurity) blocking cross-origin POSTs without a valid nonce
SecRule REQUEST_METHOD "@streq POST" \
  "chain,phase:2,deny,status:403,id:1002601,msg:'Possible CSRF against Coachify theme'"
  SecRule REQUEST_URI "@contains /wp-admin/admin.php" \
    "chain"
    SecRule &ARGS:_wpnonce "@eq 0"