---
id: "CVE-2026-92427"
kind: "vulnerability"
aliases: ["CVE-2026-92427"]
title: "Coinsnap Crowdfunding WordPress plugin: forged payment webhooks mark donations completed"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bitcoin", "coinsnap", "crowdfunding", "package", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-16T07:17:14+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T04:28:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92427", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# Coinsnap Crowdfunding WordPress plugin: forged payment webhooks mark donations completed

The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 exposes the secret used to verify its payment webhook to unauthenticated visitors. An attacker who reads that secret can send fake payment confirmations and record donations as paid, with any amount, donor name or message.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Coinsnap Bitcoin Crowdfunding plugin is installed and at version `1.2.0` or earlier, in the WordPress admin plugins list or the plugin directory under `wp-content/plugins/`.
- unknown

## Fix

- Update the Coinsnap Bitcoin Crowdfunding plugin to a version later than `1.2.0`; the sources do not name the fixed version.
- Rotate the Coinsnap webhook secret after updating, since it may already have been exposed.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92427

## From the sources

The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge payment-confirmation notifications and record arbitrary donations as completed, with attacker-chosen amounts, donor names and messages.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_