Live › vulnerability › CVE-2026-103311
Go to dashboardThe Coinbase Commerce Payment Gateway plugin for WooCommerce through 1.4.1 does not verify webhook signatures when its shared secret is left empty, which is the default. An unauthenticated attacker can send forged payment notifications to mark arbitrary orders as paid or cancel paid orders.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Coinbase Commerce Payment Gateway plugin for WooCommerce at version 1.4.1 or earlier that accept payments through Coinbase Commerce webhooks. The exposure depends on the webhook secret being empty, which is the default, so sites that configured a secret are likely not exposed. Sites that do not take Coinbase payments can skip it.
No product ranges from the sources yet.
wp plugin get coinbase-commerce --field=version (plugin slug unknown from sources, confirm it)1.4.1 (fixed version unknown from sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowing unauthenticated attackers to forge notifications that mark arbitrary orders as paid or cancel already-paid orders.
This page as .md · .json · in your agent: get_signal("CVE-2026-103311")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.