The Coinsnap Bitcoin Crowdfunding WordPress plugin version 1.2.0 and earlier fails to protect the secret that authenticates its payment‑gateway webhook. The secret is exposed to unauthenticated users, disabling the webhook's signature validation and allowing the creation of fabricated donation records with arbitrary amounts, donor names, and messages. This flaw represents an authentication bypass and is identified as CWE-200, compromising the integrity of the donation system.

The affected product is the Coinsnap Bitcoin Crowdfunding WordPress plugin through version 1.2.0. All WordPress installations that have not upgraded past 1.2.0 and that expose the webhook endpoint are vulnerable. The plugin is distributed via the WordPress repository; no additional vendor is specified.

The vulnerability can be exploited by any unauthenticated attacker who discovers the webhook endpoint, typically by querying public URLs or probing the plugin’s REST API connections. The likely attack vector is accessing the publicly exposed webhook URL and sending crafted HTTP requests with the disclosed secret. The EPSS score of < 1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, if exploitation occurs the impact is significant because forged notifications can create fully‑paid donation records with arbitrary amounts, potentially defrauding organizations. The CVSS score of 5.3 reflects moderate severity, but the financial implications raise the business risk.