Live › vulnerability › CVE-2026-92427
Go to dashboardThe Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 exposes the secret used to verify its payment webhook to unauthenticated visitors. An attacker who reads that secret can send fake payment confirmations and record donations as paid, with any amount, donor name or message.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Coinsnap Bitcoin Crowdfunding WordPress plugin through version 1.2.0 that accept Coinsnap payments for crowdfunding campaigns are exposed. Sites without this plugin, or that run a later fixed version, are not affected.
No product ranges from the sources yet.
1.2.0 or earlier, in the WordPress admin plugins list or the plugin directory under wp-content/plugins/.1.2.0; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge payment-confirmation notifications and record arbitrary donations as completed, with attacker-chosen amounts, donor names and messages.
This page as .md · .json · in your agent: get_signal("CVE-2026-92427")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.