Description
The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowing unauthenticated attackers to forge notifications that mark arbitrary orders as paid or cancel already-paid orders.
Published: 2026-10-19
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Order Status Manipulation
Action: Immediate Patch
AI Analysis

Impact

The plugin fails to verify the authenticity of payment webhook notifications because the shared secret used for signature validation is empty by default. As a result, unauthenticated attackers can forge webhook requests that change order status, marking unpaid orders as paid or cancelling paid orders.

Affected Systems

WordPress sites using the Coinbase Commerce Payment Gateway for WooCommerce plugin versions up to and including 1.4.1 are impacted. The vulnerability applies to all instances where the webhook shared secret has not been configured.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by sending unsigned webhook requests to the plugin’s endpoint, as the plugin accepts requests without validating the signature. This bypass is straightforward and does not require prior knowledge or system access beyond the ability to perform HTTP requests against the site.

Generated by OpenCVE AI on October 19, 2026 at 13:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest plugin release (1.4.2 or newer) which enforces webhook signature validation.
  • Configure a non‑empty, securely generated shared secret for webhook authentication.
  • Verify that the webhook handler rejects requests without a valid signature before processing order status changes.

Generated by OpenCVE AI on October 19, 2026 at 13:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-522
CWE-693

Mon, 19 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-345
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 09:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-522
CWE-693

Mon, 19 Oct 2026 07:00:00 +0000

Type Values Removed Values Added
Description The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowing unauthenticated attackers to forge notifications that mark arbitrary orders as paid or cancel already-paid orders.
Title Coinbase Commerce Payment Gateway for WooCommerce <= 1.4.1 - Unauthenticated Webhook Signature Bypass via Empty-Default Webhook Shared Secret
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-10-19T09:31:22.100Z

Reserved: 2026-09-30T11:40:54.464Z

Link: CVE-2026-103311

cve-icon Vulnrichment

Updated: 2026-10-19T09:25:32.703Z

cve-icon NVD

Status : Received

Published: 2026-10-19T07:16:30.260

Modified: 2026-10-19T10:16:42.823

Link: CVE-2026-103311

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T13:30:14Z

Weaknesses
  • CWE-345

    Insufficient Verification of Data Authenticity