What is the CVSS score of CVE-2026-25396?

CVE-2026-25396 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-25396?

CVE-2026-25396 presents notable security risk, a missing authorization vulnerability rated CVSS 7.5.

How to fix or mitigate CVE-2026-25396?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

WordPress CVE-2026-25396

EUVD-2026-15707 HIGH

Missing Authorization (CWE-862)

2026-03-25 Patchstack

GHSA-8mq2-frfg-qr49

WordPress Authentication Bypass

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15707

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 7.5

DescriptionCVE.org

Missing Authorization vulnerability in CoderPress Commerce Coinbase For WooCommerce commerce-coinbase-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Commerce Coinbase For WooCommerce: from n/a through <= 1.6.6.

AnalysisAI

A Missing Authorization vulnerability (CWE-862) exists in CoderPress Commerce Coinbase For WooCommerce plugin versions up to and including 1.6.6, allowing attackers to bypass access control mechanisms and perform unauthorized actions through incorrectly configured security levels. An attacker can exploit this broken access control to manipulate commerce functions or access restricted administrative features without proper authentication. No CVSS score, EPSS data, or active KEV status is currently available, but the vulnerability was reported by Patchstack and assigned EUVD ID EUVD-2026-15707.

Technical ContextAI

The vulnerability resides in the Commerce Coinbase For WooCommerce WordPress plugin (CPE: cpe:2.3:a:coderpress:commerce_coinbase_for_woocommerce:*:*:*:*:*:*:*:*), which integrates Coinbase payment processing into WooCommerce e-commerce environments. The root cause is classified as CWE-862 (Missing Authorization), indicating that the plugin fails to properly validate user permissions before allowing access to sensitive operations. WordPress plugins handling payment processing must implement strict capability checks (using functions like current_user_can()) to restrict access to authenticated and properly-privileged users; this plugin evidently lacks such controls on one or more critical functions, potentially exposing payment configuration, transaction data, or checkout logic to unauthorized parties.

RemediationAI

Update Commerce Coinbase For WooCommerce to a patched version above 1.6.6 immediately (consult the CoderPress or WordPress plugin repository for the latest available release). Until patching is completed, apply defense-in-depth mitigations: restrict plugin functionality to authenticated, high-privilege users via WordPress user roles; disable Coinbase payment processing if not actively in use; monitor access logs for unauthorized API calls to the plugin's endpoints; and consider deploying a Web Application Firewall (WAF) rule to block requests to known vulnerable plugin paths. Verify patch availability through the official WordPress plugin repository or CoderPress vendor channels before proceeding with updates.