{"id":"CVE-2026-103311","kind":"vulnerability","aliases":["CVE-2026-103311"],"related":[],"title":"WooCommerce Coinbase plugin accepts forged payment webhooks when secret is unset","description":"The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowing unauthenticated attackers to forge notifications that mark arbitrary orders as paid or cancel already-paid orders.","summary":"The Coinbase Commerce Payment Gateway plugin for WooCommerce through 1.4.1 does not verify webhook signatures when its shared secret is left empty, which is the default. An unauthenticated attacker can send forged payment notifications to mark arbitrary orders as paid or cancel paid orders.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["coinbase-commerce","package","payments","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","webhook-secret-set"],"how_to_check":"- Check the installed plugin version in the WordPress admin plugin list or `wp plugin get coinbase-commerce --field=version` (plugin slug unknown from sources, confirm it)\n- Check whether the Coinbase Commerce webhook shared secret is set in the plugin settings; an empty secret means the check is bypassed\n- Review WooCommerce orders for unexpected status changes to paid or cancelled","fix":"- Update the Coinbase Commerce Payment Gateway for WooCommerce plugin to a version later than `1.4.1` (fixed version unknown from sources)\n- Set a strong webhook shared secret in the plugin settings and regenerate it in Coinbase Commerce\n- Verify the webhook endpoint rejects requests with an invalid signature","status":"open","published_at":"2026-10-19T07:16:30+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:26:37+00:00","updated_at":"2026-10-25T04:26:37+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:26:37Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Coinbase Commerce Payment Gateway for WooCommerce plugin to a version later than `1.4.1` (fixed version unknown from sources)\n- Set a strong webhook shared secret in the plugin settings and regenerate it in Coinbase Commerce\n- Verify the webhook endpoint rejects requests with an invalid signature","reach":"internet","title":"WooCommerce Coinbase plugin accepts forged payment webhooks when secret is unset","impact":"medium","summary":"The Coinbase Commerce Payment Gateway plugin for WooCommerce through 1.4.1 does not verify webhook signatures when its shared secret is left empty, which is the default. An unauthenticated attacker can send forged payment notifications to mark arbitrary orders as paid or cancel paid orders.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","payments","coinbase-commerce"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker marks orders paid or cancels paid orders via forged webhooks","analyst_note":"Confirm the fixed plugin version and the plugin slug from the NVD entry or the plugin's changelog at https://nvd.nist.gov/vuln/detail/CVE-2026-103311.","how_to_check":"- Check the installed plugin version in the WordPress admin plugin list or `wp plugin get coinbase-commerce --field=version` (plugin slug unknown from sources, confirm it)\n- Check whether the Coinbase Commerce webhook shared secret is set in the plugin settings; an empty secret means the check is bypassed\n- Review WooCommerce orders for unexpected status changes to paid or cancelled","needs_analyst":true,"not_affected_if":["plugin-not-installed","webhook-secret-set"],"who_is_affected":"Sites running the Coinbase Commerce Payment Gateway plugin for WooCommerce at version 1.4.1 or earlier that accept payments through Coinbase Commerce webhooks. The exposure depends on the webhook secret being empty, which is the default, so sites that configured a secret are likely not exposed. Sites that do not take Coinbase payments can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000735,"input_tokens":3363,"output_tokens":797,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-103311':14A,17A '-2026':13A,16A '1.4.1':34B,79C 'accept':4A 'allow':110C 'alreadi':125C 'already-paid':124C 'arbitrari':61B,118C 'attack':53B,112C 'authent':84C 'cancel':66B,123C 'coinbas':2A,19B,26B,70C 'coinbase-commerc':18B 'commerc':20B,27B,71C 'cve':12A,15A 'default':50B,103C 'empti':46B,101C 'forg':5A,56B,114C 'gateway':29B,73C 'incom':86C 'left':45B 'mark':60B,117C 'noth':105C 'notif':58B,89C,115C 'order':62B,68B,119C,127C 'packag':21B 'paid':64B,67B,121C,126C 'payment':6A,22B,28B,57B,72C,87C 'plugin':3A,30B,77C 'reject':106C 'request':98C 'secret':9A,43B,93C,109C 'send':55B 'share':42B,92C 'signatur':39B,99C 'unauthent':52B,111C 'unconfigur':108C 'unset':11A 'use':94C 'valid':96C 'verifi':37B,82C 'webhook':7A,38B,88C 'woocommerc':1A,23B,32B,75C 'wordpress':24B,76C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Coinbase Commerce Payment Gateway plugin for WooCommerce at version 1.4.1 or earlier that accept payments through Coinbase Commerce webhooks. The exposure depends on the webhook secret being empty, which is the default, so sites that configured a secret are likely not exposed. Sites that do not take Coinbase payments can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T07:16:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103311","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103311","severity":null,"published_at":"2026-10-19T07:16:30+00:00","modified_at":"2026-10-19T21:04:50+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}