CVE-2026-92427 Coinsnap CVE debrief

Who should care

Defenders responsible for WordPress installations with the Coinsnap Bitcoin Crowdfunding plugin should assess exposure and prioritize verification of the plugin version and webhook secret access controls.

Why it matters

CVE-2026-92427 allows unauthenticated attackers to forge payment-confirmation notifications in the Coinsnap Bitcoin Crowdfunding WordPress plugin, enabling arbitrary donation recording.

• Unauthenticated attackers can forge payment-confirmation notifications.
• Arbitrary donations can be recorded with attacker-chosen amounts, donor names, and messages.
• Defenders need to verify plugin version and restrict access to the webhook secret.

Technical summary

The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows attackers to forge payment-confirmation notifications and record arbitrary donations with attacker-chosen amounts, donor names, and messages. The vulnerability affects WordPress installations with the Coinsnap Bitcoin Crowdfunding plugin, requiring defenders to verify plugin versions and restrict access to the webhook secret.

Defensive priority

Defenders should prioritize verifying the plugin version and restricting access to the webhook secret.

Recommended defensive actions

• Verify the Coinsnap Bitcoin Crowdfunding WordPress plugin version and ensure it is up-to-date.
• Restrict access to the payment gateway webhook secret.
• Monitor for suspicious payment-confirmation notifications.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook. This allows unauthenticated users to access the secret, rendering the webhook's signature check ineffective. Evidence is based on public CVE Program records and NIST NVD vulnerability assessments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.