CVE-2026-92427: Coinsnap Bitcoin Crowdfunding <= 1.2.0 - Unauthenticated Payment Record Forgery via Webhook Secret Disclosure

Q: Who can exploit this issue?

Any unauthenticated attacker who can access the affected plugin can obtain the webhook secret and submit forged payment-confirmation notifications. No valid WordPress account or legitimate payment is required.

Q: What can a successful attacker change?

An attacker can cause arbitrary donations to be recorded as completed. They can choose the recorded donation amount, donor name, and donor message.

Q: Which plugin versions are affected?

Coinsnap Bitcoin Crowdfunding versions through 1.2.0 are affected.

Published Oct 16, 2026

Updated

The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge payment-confirmation notifications and record arbitrary donations as completed, with attacker-chosen amounts, donor names and messages.

Affected Software

1 affected component

Coinsnap Bitcoin Crowdfunding<=1.2.0

Event History

Oct 16, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated attacker who can access the affected plugin can obtain the webhook secret and submit forged payment-confirmation notifications. No valid WordPress account or legitimate payment is required.

What can a successful attacker change?

An attacker can cause arbitrary donations to be recorded as completed. They can choose the recorded donation amount, donor name, and donor message.

Which plugin versions are affected?

Coinsnap Bitcoin Crowdfunding versions through 1.2.0 are affected.

CVE-2026-92427: Coinsnap Bitcoin Crowdfunding <= 1.2.0 - Unauthenticated Payment Record Forgery via Webhook Secret Disclosure

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What can a successful attacker change?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What can a successful attacker change?

Which plugin versions are affected?