CVE-2026-103311 in Coinbase Commerce Payment Gateway for WooCommerce Plugin
Summary
by MITRE • 10/19/2026
The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowing unauthenticated attackers to forge notifications that mark arbitrary orders as paid or cancel already-paid orders.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in Coinbase Commerce Payment Gateway for WooCommerce versions through 1.4.1 represents a critical failure in authentication logic within the plugin's webhook handling mechanism. Webhooks are essential components of modern e-commerce integrations, serving as asynchronous notifications from payment processors to merchant systems regarding transaction status changes such as payments received or refunds issued. In this specific implementation, the system relies on a shared secret key to verify the authenticity and integrity of incoming HTTP requests originating from Coinbase Commerce servers. The core technical flaw lies in the default configuration state where this shared secret is initialized as an empty string. Furthermore, the validation logic fails to enforce strict requirements for non-empty secrets before processing webhook payloads. Consequently, any request lacking a valid signature or possessing an invalid one due to an unconfigured secret is accepted by the application without rejection. This design oversight effectively bypasses the intended authentication layer, allowing external actors to interact with the payment state machine as if they were legitimate Coinbase Commerce servers.
The operational impact of this vulnerability is severe and directly affects financial integrity and order management processes within WooCommerce stores utilizing this plugin. An unauthenticated attacker can exploit this flaw by crafting malicious HTTP POST requests that mimic valid webhook notifications from Coinbase Commerce. By forging these payloads, the attacker can manipulate the status of arbitrary orders in the WordPress database without possessing any legitimate credentials or API keys associated with the merchant's account. Specifically, an attacker can send a forged notification indicating that payment has been received for an order that was previously unpaid or pending. This action triggers the store to process and ship goods under the false assumption that financial compensation has occurred. Conversely, the vulnerability also allows attackers to forge cancellation notifications, which may result in legitimate paid orders being marked as cancelled, leading to customer dissatisfaction and potential disputes with payment processors. The ability to arbitrarily alter order states undermines trust in the automated checkout flow and exposes merchants to direct monetary loss through fraud or operational disruption.
From a classification perspective, this vulnerability aligns closely with CWE-287 Improper Authentication, specifically regarding the failure to verify identity before granting access to sensitive functions. Additionally, it relates to CWE-345 Insufficient Verification of Data Authenticity, as the system fails to validate that the incoming data originated from its expected source and has not been tampered with during transit. In terms of offensive security frameworks such as MITRE ATT&CK, this exploit technique corresponds to T1078 Valid Accounts or more broadly to techniques involving the abuse of legitimate services for unauthorized access, although in this context it is better described under data manipulation tactics where an attacker alters system state by spoofing trusted inputs. The lack of signature verification means that even if a merchant attempts to secure their webhook endpoint via IP whitelisting alone, they remain vulnerable because Coinbase Commerce may utilize multiple dynamic IP addresses or the attacker might bypass network-level controls through other vectors, making cryptographic validation essential for integrity assurance.
To mitigate this vulnerability and restore security posture, immediate remediation steps are required by both plugin developers and store administrators. For users of affected versions up to 1.4.1, upgrading to a patched version that enforces strict signature verification is the primary recommendation. The patch should ensure that the shared secret cannot be left empty or null during initialization and must require explicit configuration before any webhook processing occurs. Administrators who have not yet upgraded should manually configure a strong, random shared secret within the plugin settings if such an option exists in their current version, ensuring it matches exactly what is configured on the Coinbase Commerce dashboard. It is critical to verify that no empty strings are accepted as valid credentials during the signature comparison process. Furthermore, implementing additional defense-in-depth measures such as validating HTTP headers for expected content types and restricting webhook endpoints via server-side firewall rules can provide supplementary protection while awaiting full patch deployment. Regular security audits of third-party WordPress plugins are also advised to identify similar patterns where default configurations lack necessary cryptographic safeguards against request forgery attacks.