CVE-2026-103311

The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowin...

EUVD-2026-104095

The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowin...

CVE-2026-103311 Coinbase Commerce Payment Gateway for WooCommerce <= 1.4.1 - Unauthenticated Webhook Signature Bypass via Empty-Default Webhook Shared Secret

The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowin...

CVE-2026-103311 Coinbase Commerce Payment Gateway for WooCommerce <= 1.4.1 - Unauthenticated Webhook Signature Bypass via Empty-Default Webhook Shared Secret

The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowin...

CVE-2026-103311

The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin, versions through 1.4.1 , contains a vulnerability allowing an unauthenticated webhook signature bypass . The root cause is that the shared secret used for request signature validation is empty by default , and the system fail...

PT-2026-117240

Name of the Vulnerable Software and Affected Versions Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin versions prior to 1.4.2 Description The plugin fails to verify the authenticity of incoming payment webhook notifications. This occurs because the shared secret used to validat...

CVE-2026-103311: Insufficient Verification of Data Authenticity

The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowin...

PT-2026-114786

The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated attackers to forge an approved-payment notification and mar...

PT-2026-94187

Name of the Vulnerable Software and Affected Versions Robokassa payment gateway for Woocommerce WordPress plugin versions prior to 1.8.9 Description The plugin fails to verify the authenticity of incoming payment notifications when the non-default deferred-payment feature is enabled. This allows...