Coinbase Commerce Payment Gateway For Woocommerce
Monthly
Forged Coinbase Commerce webhook notifications can mark arbitrary WooCommerce orders as paid or cancel already-paid orders in the Coinbase Commerce Payment Gateway plugin through version 1.4.1. The plugin ships with an empty webhook shared secret and does not reject an unconfigured value, so unauthenticated remote attackers who know or guess an order ID can bypass signature validation; publicly available exploit code exists. The CVSS 5.3 impact is limited to order-payment integrity with no confidentiality or availability impact, and merchants who have explicitly set a non-empty shared secret are not affected by the bypass.
Forged Coinbase Commerce webhook notifications can mark arbitrary WooCommerce orders as paid or cancel already-paid orders in the Coinbase Commerce Payment Gateway plugin through version 1.4.1. The plugin ships with an empty webhook shared secret and does not reject an unconfigured value, so unauthenticated remote attackers who know or guess an order ID can bypass signature validation; publicly available exploit code exists. The CVSS 5.3 impact is limited to order-payment integrity with no confidentiality or availability impact, and merchants who have explicitly set a non-empty shared secret are not affected by the bypass.