EUVD-2026-102685
GHSA-q2gj-9cv7-25w7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRetrieve exposed webhook secret as unauthenticated user
-
ExploitForge signed payment-confirmation notification
-
ExecutionSubmit request to plugin webhook endpoint
-
ImpactRecord fraudulent completed donation with attacker-chosen details
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a target running the Coinsnap Bitcoin Crowdfunding WordPress plugin version 1.2.0 or earlier with its Bitcoin payment-gateway webhook functionality in use. No special configuration, authentication, or user interaction is needed (AV:N/AC:L/PR:N/UI:N) - any unauthenticated remote user can read the exposed webhook secret and therefore defeat the signature check against default installations. The practical limit is footprint rather than access: the flaw only matters on sites that have this specific crowdfunding plugin installed and active, and the impact is confined to falsifying donation/payment records (integrity), not server compromise or sensitive-data theft. |
| Impact | Signals are consistent and point to a genuine but moderate-severity issue rather than a top-priority emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms fully remote, unauthenticated, low-complexity exploitation with no user interaction, which is the worst case for accessibility; however the aggregate base score is only 5.3 because impact is limited to Integrity (I:L) with no Confidentiality or Availability effect in the official scoring. A public exploit exists (POC=YES, reported by WPScan), which raises practical exploitability, but EPSS is very low at 0.14% (3rd percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active or widespread exploitation - the low EPSS despite public POC suggests limited attacker interest, consistent with a niche plugin and a non-code-execution impact. Note a signal nuance: CWE-200/Information Disclosure and the description's emphasis on secret disclosure imply a confidentiality angle, yet the official vector scores C:N/I:L because the exploitable consequence is data falsification (forged donation records), not theft of sensitive user data - this is a reasonable choice. Overall this is a real, easily-exploitable data-integrity/fraud flaw that merits patching, but it is not a high-real-risk, drop-everything vulnerability. |
| Exploit ScenarioDerived | An unauthenticated attacker visits a site running the Coinsnap Bitcoin Crowdfunding plugin, retrieves the exposed webhook authentication secret, and uses it to craft a validly-signed payment-confirmation request. A public exploit for this issue exists (WPScan). Because exploitation is remote, low-complexity, and requires no authentication or user interaction, the attacker can record fabricated 'completed' donations with chosen amounts, donor names, and messages. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Unauthenticated remote attackers can read the webhook authentication secret exposed by the Coinsnap Bitcoin Crowdfunding WordPress plugin (versions through 1.2.0) and use it to forge payment-confirmation callbacks, recording arbitrary donations as completed with attacker-chosen amounts, donor names and messages. Exploitation requires no authentication, privileges or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3), but it is limited to sites that have this specific crowdfunding plugin installed and active with its Bitcoin payment-gateway webhook in use, and the impact stays within falsified donation records rather than server compromise or sensitive-data theft. Publicly available exploit code exists and WPScan published a dedicated vulnerability entry, while EPSS remains low at 0.14% (3rd percentile) and there is no confirmed active exploitation (CISA KEV).
RemediationAI
No vendor-released patch is identified at time of analysis, so the immediate priority is to stop relying on the compromised webhook signature check. If the plugin is not essential, deactivate and remove it - this fully removes the exposure but forfeits the crowdfunding functionality; if it must stay active, disable the Bitcoin payment-gateway webhook integration until a fixed release appears, accepting that automatic donation confirmation stops working and donations must be reconciled manually. Because the secret has effectively been public, treat it as compromised: rotate or regenerate the webhook secret and any related API credentials, and treat all historical donation and payment records as untrusted until verified against the Bitcoin gateway's own records, since forged confirmations may already be present. Restrictive compensating controls include blocking external access to the plugin endpoint or parameter that returns the webhook secret (for example with a WAF rule or web-server ACL), which stops further secret harvesting but does not repair records already falsified and can break legitimate gateway callbacks if the same route is used; additionally, restrict webhook traffic to the payment provider's published source addresses, which reduces forgery surface but requires maintaining an up-to-date address list. Monitor WPScan (https://wpscan.com/vulnerability/a5320c81-5ad9-471d-9c58-726b585b801e/) and the NVD record (https://nvd.nist.gov/vuln/detail/CVE-2026-92427) for a patched release, and update as soon as one is published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a WordPress plugin that integrates a Bitcoin payment gateway with a crowdfunding front end. Like most webhook integrations, it authenticates inbound payment-platform callbacks by verifying a signature computed with a shared secret; the plugin fails to protect that secret, making it readable by unauthenticated users and thereby collapsing the signature check into a no-op. The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) rather than a logic or injection flaw: the cryptographic mechanism itself is not broken, the key material is simply disclosed. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, the scored impact is integrity-only, with no confidentiality or availability effect and no scope change - the value of the leaked secret is that it lets an attacker mint authentic-looking "payment confirmed" notifications, which the plugin then processes as legitimate donation state. The supplied CPE (cpe:2.3:a:unknown:coinsnap_bitcoin_crowdfunding:*:*:*:*:*:*:*:*) is a wildcard with an unmapped vendor, so version scoping must be taken from the vendor/aggregator data instead: WPScan and ENISA EUVD (EUVD-2026-102685) both place all versions up to and including 1.2.0 in scope, meaning default installations of the affected release line are vulnerable without any unusual configuration.
Know when Coinsnap Bitcoin Crowdfunding gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Remote, unauthenticated, low-complexity secret disclosure enabling forged donation records; impact is integrity-only (I:L) with no confidentiality of sensitive user data or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge payment-confirmation notifications and record arbitrary donations as completed, with attacker-chosen amounts, donor names and messages.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB