---
id: "CVE-2026-103311"
kind: "vulnerability"
aliases: ["CVE-2026-103311"]
title: "WooCommerce Coinbase plugin accepts forged payment webhooks when secret is unset"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["coinbase-commerce", "package", "payments", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed", "webhook-secret-set"]
published_at: "2026-10-19T07:16:30+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T04:26:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103311", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# WooCommerce Coinbase plugin accepts forged payment webhooks when secret is unset

The Coinbase Commerce Payment Gateway plugin for WooCommerce through 1.4.1 does not verify webhook signatures when its shared secret is left empty, which is the default. An unauthenticated attacker can send forged payment notifications to mark arbitrary orders as paid or cancel paid orders.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin plugin list or `wp plugin get coinbase-commerce --field=version` (plugin slug unknown from sources, confirm it)
- Check whether the Coinbase Commerce webhook shared secret is set in the plugin settings; an empty secret means the check is bypassed
- Review WooCommerce orders for unexpected status changes to paid or cancelled

## Fix

- Update the Coinbase Commerce Payment Gateway for WooCommerce plugin to a version later than `1.4.1` (fixed version unknown from sources)
- Set a strong webhook shared secret in the plugin settings and regenerate it in Coinbase Commerce
- Verify the webhook endpoint rejects requests with an invalid signature

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103311

## From the sources

The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowing unauthenticated attackers to forge notifications that mark arbitrary orders as paid or cancel already-paid orders.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_