CVE-2026-92427

LOWCVSS 5.3 · MEDIUM

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge payment-confirmation notifications and record arbitrary donations as completed, with attacker-chosen amounts, donor names and messages.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://wpscan.com/vulnerability/a5320c81-5ad9-471d-9c58-726b585b801e/

Weakness type (CWE)

CWE-200

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse1 post

CVE@CVEnew1d
CVE-2026-92427 The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing i… https://www.cve.org/CVERecord?id=CVE-2026-92427
00000434
58.3K followersView on X

Explore more

Back to dashboard