Coinbase Commerce Gateway CVE-2026-103311

Exploitation requires that the plugin's Coinbase Commerce webhook shared secret is left empty, which is the DEFAULT state - the plugin does not reject an unconfigured secret, so any store that has not manually set a valid secret is vulnerable out of the box. The attacker needs network reachability to the public webhook endpoint and knowledge or guessing of a target order ID; no authentication, credentials, or user interaction are required (PR:N/UI:N). The primary limiting factor is that a merchant who has explicitly configured a non-empty, correct shared secret would cause forged notifications to fail signature validation, mitigating the issue; impact is also bounded to WooCommerce order payment status (mark-paid or cancel) rather than full site compromise.

This is a genuine but moderate-severity risk rather than a critical priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) correctly reflects that a remote, unauthenticated attacker can trigger the flaw over the network with low complexity and no user interaction, which is confirmed by the root cause: webhook signature validation is effectively disabled because the shared secret is empty by default and an unconfigured secret is not rejected. However, the score is held to 5.3 by the limited impact (C:N/I:L/A:N, scope unchanged) - the attacker manipulates WooCommerce order payment state rather than achieving code execution or data theft. A public proof-of-concept exists (WPScan), raising practical exploitability, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation - this signals an opportunistic/targeted fraud risk against individual stores rather than mass exploitation at this time. The main judgement caveat: CVSS rates impact as only I:L, but the business consequence (marking unpaid orders as paid to obtain goods for free, or cancelling legitimate paid orders) can be financially significant for the affected merchant despite the modest numeric score.

An attacker identifies a WooCommerce store running this plugin with the default (empty) webhook secret, places or targets an order, then sends a forged Coinbase Commerce webhook notification directly to the store's webhook endpoint. Because the empty shared secret is not rejected, the forged signature passes validation and the order is marked 'paid,' letting the attacker receive goods or services without payment; the same technique can cancel already-paid orders to disrupt the merchant. A public PoC from WPScan lowers the skill required to carry this out.