CVE-2026-25337: 
WordPress vulnerability analysis and mitigation

CVE-2026-25337 is a Cross-Site Request Forgery (CSRF) vulnerability in the Coachify WordPress theme developed by wpcoachify. It affects all versions of the theme up to and including 1.1.5, and was published on February 19, 2026. The vulnerability was discovered and reported by researcher Trương Hữu Phúc (truonghuuphuc) and disclosed by Patchstack on February 8, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), meaning the Coachify theme fails to properly validate or verify the origin of state-changing HTTP requests. An unauthenticated attacker can craft a malicious web page or link that, when visited by an authenticated WordPress user (such as an administrator), causes the victim's browser to submit unauthorized requests on their behalf. Exploitation requires user interaction — specifically, a privileged user must be tricked into clicking a malicious link or visiting a crafted page while authenticated to the WordPress site (Patchstack).

Successful exploitation allows a malicious actor to force higher-privileged WordPress users to execute unwanted actions under their current authentication context, such as modifying theme settings or site content. The confidentiality impact is none, while integrity and availability impacts are both rated low. The attack scope is limited to the affected WordPress installation and does not provide direct access to the underlying server or enable lateral movement (Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is extremely low at 0.000080, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class can be used in mass-exploit campaigns targeting WordPress sites at scale, though this specific issue is rated low priority (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Coachify theme at version 1.1.5 or earlier, which can be detected via HTTP response headers, page source, or tools like WPScan.
2. Craft malicious payload: Create an HTML page or form that automatically submits a state-changing request (e.g., modifying theme options) to the target WordPress site's admin endpoint, without a valid CSRF nonce.
3. Social engineering: Deliver the malicious link or page to an authenticated WordPress administrator via phishing email, forum post, or other social engineering vector.
4. Trigger exploitation: When the authenticated admin visits the crafted page, their browser automatically submits the forged request, causing the WordPress site to execute the unauthorized action under the admin's session (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to admin endpoints (e.g., wp-admin/admin-post.php or theme options pages) from unusual referrer URLs or external domains.
• Logs: Admin action logs (if an audit plugin is installed) recording theme setting changes at unusual times or without corresponding admin login activity.
• Network: HTTP requests to WordPress admin URLs originating from non-administrative IP addresses or with suspicious Referer headers pointing to external sites.

The vulnerability is patched in Coachify theme version 1.1.6. Site administrators should update the Coachify theme to version 1.1.6 or later immediately. If an immediate update is not possible, consider restricting access to the WordPress admin panel by IP allowlist or using a web application firewall (WAF) with CSRF protection rules as a temporary measure (Patchstack).