CVE-2026-103311: Coinbase Commerce Payment Gateway for WooCommerce <= 1.4.1 - Unauthenticated Webhook Signature Bypass via Empty-Default Webhook Shared Secret
The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowing unauthenticated attackers to forge notifications that mark arbitrary orders as paid or cancel already-paid orders.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure a non-empty webhook shared secret so incoming payment webhook signatures are validated.
Coinbase Commerce Payment Gateway for WooCommerce webhook shared secret = non-empty
Event History
Frequently Asked Questions
Which sites are exposed?
Sites using Coinbase Commerce Payment Gateway for WooCommerce through version 1.4.1 are exposed if the webhook shared secret has been left unconfigured. The plugin uses an empty shared secret by default and does not reject that condition.
What does an attacker need to exploit this issue?
An attacker can send forged payment webhook notifications without authentication when the shared secret is empty. No privileges or user interaction are required.
What could a successful forged webhook do?
Forged notifications can mark arbitrary orders as paid or cancel orders that were already paid. This affects order integrity rather than confidentiality or availability.
How can I determine whether my site is currently vulnerable?
Check whether the plugin is version 1.4.1 or earlier and whether its webhook shared secret is configured. An empty or unconfigured secret leaves incoming webhook signatures unauthenticated.
What can be done if updating is not immediately possible?
Configure a non-empty webhook shared secret so webhook signatures can be validated. Review order-status changes for unexpected paid or cancelled orders, as forged notifications may already have altered them.