What is the CVSS score of EUVD-2026-29408?

EUVD-2026-29408 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Coinbase Commerce for Contact Form 7 EUVD-2026-29408

| CVE-2026-6709 MEDIUM

Missing Authorization (CWE-862)

2026-05-12 Wordfence

GHSA-w945-6648-pwv3

Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:48 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

MEDIUM 4.3

DescriptionCVE.org

The Coinbase Commerce for Contact Form 7 plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.1.2. This is due to a missing capability check and missing nonce verification in the save_settings() function, which is registered on the admin_post_cccf7_save_settings hook. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin's Coinbase Commerce API key option (cccf7_api_key) via a crafted POST request to /wp-admin/admin-post.

AnalysisAI

Authenticated attackers with Subscriber-level WordPress access can overwrite the Coinbase Commerce API key in versions up to 1.1.2 of the Coinbase Commerce for Contact Form 7 WordPress plugin due to missing capability checks and nonce verification in the save_settings() function. The vulnerability allows privilege escalation and potential compromise of payment processing by replacing the legitimate API key with an attacker-controlled value via a crafted POST request to /wp-admin/admin-post, affecting all WordPress sites running this plugin with that version or earlier.

Technical ContextAI

The vulnerability exists in the save_settings() function registered on the admin_post_cccf7_save_settings hook within the plugin's class-admin-settings.php file. The function handles POST requests to /wp-admin/admin-post but fails to implement WordPress's standard security mechanisms: capability checks (which verify user roles) and nonce verification (which prevents CSRF attacks). This is a critical gap in WordPress plugin security architecture, as the admin_post hook typically processes privileged administrative actions. The affected option (cccf7_api_key) stores sensitive Coinbase Commerce API credentials, making its unauthorized modification a high-impact concern. The underlying weakness is a Missing Authorization flaw (CWE-862) where the plugin trusts any authenticated user rather than validating their administrative role.

RemediationAI

Update the Coinbase Commerce for Contact Form 7 plugin to a patched version beyond 1.1.2 immediately. WordPress site administrators should navigate to the Plugins menu, locate the plugin, and click Update if a newer version is available. If no patched version has been released by CoderPress, apply these compensating controls: (1) disable Subscriber-level accounts for all non-editorial users and require Editor or Administrator role for payment-related access; (2) restrict access to /wp-admin/admin-post.php endpoints via Web Application Firewall (WAF) rules or .htaccess to block POST requests with the cccf7_save_settings action parameter from non-administrative IP ranges; (3) regularly audit the cccf7_api_key option via database queries or WordPress admin interface to detect unauthorized changes, and maintain an offline backup of the legitimate key. Additionally, regenerate the Coinbase Commerce API key in your Coinbase account after patching to ensure no malicious keys are active. Check the Wordfence threat intelligence link (https://www.wordfence.com/threat-intel/vulnerabilities/id/9bff2532-802c-4bb1-a0a2-7f5f928deb23) for the latest patch status and advisory details.