{"id":"CVE-2026-92427","kind":"vulnerability","aliases":["CVE-2026-92427"],"related":[],"title":"Coinsnap Crowdfunding WordPress plugin: forged payment webhooks mark donations completed","description":"The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge payment-confirmation notifications and record arbitrary donations as completed, with attacker-chosen amounts, donor names and messages.","summary":"The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 exposes the secret used to verify its payment webhook to unauthenticated visitors. An attacker who reads that secret can send fake payment confirmations and record donations as paid, with any amount, donor name or message.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bitcoin","coinsnap","crowdfunding","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the Coinsnap Bitcoin Crowdfunding plugin is installed and at version `1.2.0` or earlier, in the WordPress admin plugins list or the plugin directory under `wp-content/plugins/`.\n- unknown","fix":"- Update the Coinsnap Bitcoin Crowdfunding plugin to a version later than `1.2.0`; the sources do not name the fixed version.\n- Rotate the Coinsnap webhook secret after updating, since it may already have been exposed.","status":"open","published_at":"2026-10-16T07:17:14+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:28:35+00:00","updated_at":"2026-10-25T04:28:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:28:35Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Coinsnap Bitcoin Crowdfunding plugin to a version later than `1.2.0`; the sources do not name the fixed version.\n- Rotate the Coinsnap webhook secret after updating, since it may already have been exposed.","reach":"internet","title":"Coinsnap Crowdfunding WordPress plugin: forged payment webhooks mark donations completed","impact":"medium","summary":"The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 exposes the secret used to verify its payment webhook to unauthenticated visitors. An attacker who reads that secret can send fake payment confirmations and record donations as paid, with any amount, donor name or message.","category":"package","nicknames":[],"who_cares":["wordpress","coinsnap","crowdfunding","bitcoin"],"confidence":0.7,"needs_auth":"no","worst_case":"Attackers record fake donations as paid with chosen amounts and names","analyst_note":"Check the NVD entry or the plugin changelog for the fixed version and whether the webhook secret leaks via a specific endpoint or setting.","how_to_check":"- Check whether the Coinsnap Bitcoin Crowdfunding plugin is installed and at version `1.2.0` or earlier, in the WordPress admin plugins list or the plugin directory under `wp-content/plugins/`.\n- unknown","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Coinsnap Bitcoin Crowdfunding WordPress plugin through version 1.2.0 that accept Coinsnap payments for crowdfunding campaigns are exposed. Sites without this plugin, or that run a later fixed version, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000664,"input_tokens":3376,"output_tokens":653,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-92427':13A,16A '1.2.0':29B,72C 'access':76C 'allow':101C 'amount':60B,120C 'arbitrari':112C 'attack':43B,103C,118C 'attacker-chosen':117C 'authent':82C 'bitcoin':17B,24B,67C 'check':98C 'chosen':119C 'coinsnap':1A,18B,23B,66C 'complet':10A,115C 'confirm':52B,108C 'crowdfund':2A,19B,25B,68C 'cve':11A,14A 'disclos':87C 'donat':9A,55B,113C 'donor':61B,121C 'expos':30B 'fake':50B 'forg':5A,105C 'gateway':85C 'ineffect':99C 'mark':8A 'messag':64B,124C 'name':62B,122C 'notif':109C 'packag':20B 'paid':57B 'payment':6A,37B,51B,84C,107C 'payment-confirm':106C 'plugin':4A,27B,70C 'read':45B 'record':54B,111C 'render':93C 'restrict':75C 'secret':32B,47B,79C 'send':49B 'signatur':97C 'unauthent':40B,90C,102C 'use':33B,80C 'user':91C 'verifi':35B 'visitor':41B 'webhook':7A,38B,86C,95C 'wordpress':3A,21B,26B,69C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Coinsnap Bitcoin Crowdfunding WordPress plugin through version 1.2.0 that accept Coinsnap payments for crowdfunding campaigns are exposed. Sites without this plugin, or that run a later fixed version, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T07:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92427","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92427","severity":null,"published_at":"2026-10-16T07:17:14+00:00","modified_at":"2026-10-16T15:17:35+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}