CVE-2026-103311
Deferred Deferred - Pending Action

Authentication Bypass in Coinbase Commerce Payment Gateway for WooCommerce

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: WPScan

Description
The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowing unauthenticated attackers to forge notifications that mark arbitrary orders as paid or cancel already-paid orders.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-11-08
AI Q&A
2026-10-19
EPSS Evaluated
2026-11-07
NVD
CVE-2026-103311
EUVD
EUVD-2026-104095

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Coinbase Commerce Payment Gateway for WooCommerce 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Coinbase Commerce Payment Gateway for WooCommerce plugin up to version 1.4.1. It allows unauthenticated attackers to forge webhook notifications because the shared secret used to validate payment signatures is empty by default and not enforced. Attackers can mark arbitrary orders as paid or cancel already-paid orders without proper authentication.

Detection Guidance

Check if the Coinbase Commerce Payment Gateway for WooCommerce plugin is installed and verify its version. If it is version 1.4.1 or lower, the system is vulnerable. Inspect plugin settings to confirm if the shared secret is empty or unconfigured.

Impact Analysis

If you use the affected plugin, attackers could manipulate order statuses, leading to financial losses from unpaid orders marked as paid or canceled paid orders. This could disrupt transactions and damage customer trust. The vulnerability is critical due to the potential for unauthorized actions without authentication.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized changes to payment statuses, which may lead to improper handling of financial transactions and personal data. Unauthenticated attackers could manipulate order statuses, risking incorrect financial reporting and potential violations of data integrity and confidentiality requirements.

Mitigation Strategies

Update the plugin to the latest version if available. If no update exists, disable the plugin immediately. Configure a strong shared secret in the plugin settings to enable webhook signature verification.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103311. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...