CVE-2026-103311: Coinbase Commerce WooCommerce Auth Bypass

CVE-2026-103311 Overview

CVE-2026-103311 affects the Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through version 1.4.1. The plugin fails to verify the authenticity of incoming payment webhook notifications because the shared secret used to validate request signatures is empty by default. The plugin does not reject requests when the secret is unconfigured. Unauthenticated attackers can forge webhook notifications to mark arbitrary orders as paid or cancel already-paid orders. The flaw is classified under CWE-345: Insufficient Verification of Data Authenticity.

Critical Impact

Unauthenticated remote attackers can manipulate WooCommerce order payment states, enabling fraudulent order fulfillment or disruption of legitimate transactions.

Affected Products

• Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin
• All versions through 1.4.1
• WooCommerce stores accepting Coinbase cryptocurrency payments

Discovery Timeline

• 2026-10-19 - CVE-2026-103311 published to NVD
• 2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-103311

Vulnerability Analysis

The plugin implements a webhook endpoint to receive payment status updates from Coinbase Commerce. These webhooks drive order state transitions in WooCommerce, including marking orders as paid, failed, or cancelled. Webhook authenticity should be verified using an HMAC signature computed from a shared secret agreed upon between the plugin and Coinbase.

In vulnerable builds, the shared secret defaults to an empty string. The signature verification routine does not reject requests when the secret is unconfigured, so forged notifications pass validation. Any network attacker can send crafted HTTP POST requests to the webhook endpoint and manipulate order state without authentication.

The business impact depends on the merchant workflow. Attackers can mark unpaid orders as paid to trigger shipment of goods or digital delivery. They can also cancel already-paid orders to disrupt revenue and customer trust.

Root Cause

The root cause is a missing precondition check in the webhook handler. The plugin treats an empty or unconfigured shared secret as a valid configuration state rather than failing closed. Signature comparison against an empty secret allows attacker-controlled payloads to be accepted as authentic Coinbase notifications.

Attack Vector

Exploitation requires only network access to the WordPress site's webhook endpoint. The attacker crafts an HTTP POST payload mimicking a Coinbase Commerce event, such as charge:confirmed or charge:failed, and submits it to the plugin's webhook URL. No authentication, user interaction, or elevated privileges are required. See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-103311

Indicators of Compromise

• Orders transitioning to processing or completed status without a corresponding Coinbase transaction confirmation in the merchant dashboard.
• Webhook POST requests to the Coinbase Commerce callback endpoint originating from IP addresses outside Coinbase's published ranges.
• Unexpected order cancellations on previously confirmed paid orders without matching chargeback or refund events.

Detection Strategies

• Audit WooCommerce order history for state transitions that lack matching entries in the Coinbase Commerce merchant portal.
• Review web server access logs for POST requests to the plugin's webhook URL and correlate request source IPs against Coinbase's documented origin addresses.
• Alert on webhook events where the X-CC-Webhook-Signature header is missing, malformed, or validated against an empty secret.

Monitoring Recommendations

• Enable verbose logging on the Coinbase Commerce plugin webhook handler to capture request headers, payloads, and verification outcomes.
• Reconcile WooCommerce order status changes with Coinbase Commerce API records on a scheduled basis.
• Monitor for anomalous spikes in order completions tied to the Coinbase payment method.

How to Mitigate CVE-2026-103311

Immediate Actions Required

• Configure a strong, non-empty shared webhook secret in both the plugin settings and the Coinbase Commerce merchant dashboard.
• Audit all recent orders processed through the Coinbase Commerce gateway and verify payment status against Coinbase records.
• Temporarily disable the Coinbase Commerce payment method if a secret cannot be configured immediately.

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry for versions beyond 1.4.1. Monitor the WPScan advisory and the plugin's WordPress.org page for an official security release. Apply the patched version as soon as it is available.

Workarounds

• Restrict access to the webhook endpoint using web application firewall rules that allow only Coinbase Commerce source IP ranges.
• Require manual verification of cryptocurrency payments through the Coinbase merchant dashboard before fulfilling orders.
• Remove or deactivate the plugin until a patched version is released and a valid shared secret is in place.

# Example: restrict webhook endpoint via nginx to Coinbase IP ranges
location ~ ^/wp-json/.*coinbase.* {
    allow 54.175.255.192/27;
    deny all;
}