CVE-2026-1380: Bitcoin Donate Button CSRF Vulnerability

CVE-2026-1380 Overview

The Bitcoin Donate Button plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 1.0. This security flaw stems from missing or incorrect nonce validation on the plugin's settings page, which enables unauthenticated attackers to modify critical plugin configurations without authorization.

Critical Impact

Attackers can manipulate donation addresses and display configurations through forged requests, potentially redirecting cryptocurrency donations to attacker-controlled wallets when administrators are tricked into clicking malicious links.

Affected Products

• Bitcoin Donate Button plugin for WordPress versions up to and including 1.0

Discovery Timeline

• 2026-01-28 - CVE CVE-2026-1380 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-1380

Vulnerability Analysis

This vulnerability is classified as CWE-352 (Cross-Site Request Forgery). The Bitcoin Donate Button plugin fails to implement proper nonce validation on its administrative settings page. Nonces (number used once) are WordPress security tokens designed to prevent CSRF attacks by ensuring that requests originate from legitimate, authenticated sessions.

Without proper nonce verification, the plugin cannot distinguish between legitimate administrator actions and malicious forged requests. This allows attackers to craft malicious web pages or links that, when visited by an authenticated administrator, execute unauthorized changes to the plugin's configuration.

Root Cause

The root cause lies in the btcbutton.php file where the settings form handler processes configuration changes without verifying a valid WordPress nonce token. The plugin's settings submission endpoint accepts and processes requests based solely on the presence of POST parameters, without confirming the request's authenticity.

WordPress provides built-in functions like wp_nonce_field() for form generation and wp_verify_nonce() for validation, but these security controls are either missing or improperly implemented in the vulnerable plugin version.

Attack Vector

The attack requires network access and user interaction from a site administrator. An attacker crafts a malicious HTML page containing a hidden form that targets the vulnerable plugin's settings endpoint. When an authenticated WordPress administrator visits this malicious page (via phishing email, compromised website, or social engineering), the form automatically submits to the WordPress site.

Since the administrator's browser includes valid authentication cookies, and the plugin lacks CSRF protection, the forged request is processed as legitimate. This allows attackers to modify donation Bitcoin addresses to their own wallets, alter display configurations, or manipulate other plugin settings without the administrator's knowledge or consent.

Detection Methods for CVE-2026-1380

Indicators of Compromise

• Unexpected changes to Bitcoin Donate Button plugin settings, particularly donation wallet addresses
• Administrator access logs showing settings modifications without corresponding legitimate administrative sessions
• Referrer headers in HTTP logs indicating settings changes originating from external domains
• User reports of donation addresses differing from expected organizational wallets

Detection Strategies

• Implement file integrity monitoring on the btcbutton.php plugin file and WordPress options table entries related to the plugin
• Monitor WordPress admin action logs for unauthorized or unexpected plugin configuration changes
• Deploy web application firewall rules to detect and block CSRF attack patterns targeting WordPress plugin endpoints
• Enable detailed HTTP request logging to capture referrer information for settings modification requests

Monitoring Recommendations

• Configure alerts for any Bitcoin Donate Button settings changes, requiring secondary verification before deployment
• Implement change management workflows for plugin configurations with audit trails
• Review WordPress audit logs regularly for administrative actions performed during suspicious time periods
• Monitor for phishing campaigns targeting WordPress administrators that could facilitate CSRF exploitation

How to Mitigate CVE-2026-1380

Immediate Actions Required

• Immediately audit and verify all Bitcoin Donate Button plugin settings, especially donation wallet addresses
• Consider temporarily disabling the Bitcoin Donate Button plugin until a patched version becomes available
• Educate administrators about phishing risks and the importance of verifying links before clicking
• Implement additional security layers such as two-factor authentication for WordPress administrative access

Patch Information

No official patch information is currently available for this vulnerability. Organizations should monitor the WordPress Plugin Repository for updated versions and review the Wordfence Vulnerability Analysis for ongoing advisories.

Workarounds

• Restrict access to the WordPress administrative interface using IP allowlisting or VPN requirements
• Implement a Content Security Policy (CSP) to help prevent cross-origin form submissions
• Use a web application firewall configured to detect and block CSRF attack patterns
• Administrators should avoid clicking links in emails or messages while logged into the WordPress admin panel

# Example: Restrict WordPress admin access by IP in .htaccess
<Files wp-login.php>
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Files>