Coinsnap Bitcoin Crowdfunding
Monthly
Unauthenticated remote attackers can read the webhook authentication secret exposed by the Coinsnap Bitcoin Crowdfunding WordPress plugin (versions through 1.2.0) and use it to forge payment-confirmation callbacks, recording arbitrary donations as completed with attacker-chosen amounts, donor names and messages. Exploitation requires no authentication, privileges or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3), but it is limited to sites that have this specific crowdfunding plugin installed and active with its Bitcoin payment-gateway webhook in use, and the impact stays within falsified donation records rather than server compromise or sensitive-data theft. Publicly available exploit code exists and WPScan published a dedicated vulnerability entry, while EPSS remains low at 0.14% (3rd percentile) and there is no confirmed active exploitation (CISA KEV).
Unauthenticated remote attackers can read the webhook authentication secret exposed by the Coinsnap Bitcoin Crowdfunding WordPress plugin (versions through 1.2.0) and use it to forge payment-confirmation callbacks, recording arbitrary donations as completed with attacker-chosen amounts, donor names and messages. Exploitation requires no authentication, privileges or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3), but it is limited to sites that have this specific crowdfunding plugin installed and active with its Bitcoin payment-gateway webhook in use, and the impact stays within falsified donation records rather than server compromise or sensitive-data theft. Publicly available exploit code exists and WPScan published a dedicated vulnerability entry, while EPSS remains low at 0.14% (3rd percentile) and there is no confirmed active exploitation (CISA KEV).