CVE-2026-92427

Name of the Vulnerable Software and Affected Versions Coinsnap Bitcoin Crowdfunding WordPress plugin versions prior to 1.2.1

Description The plugin fails to restrict access to the secret used to authenticate its payment gateway webhook, allowing unauthenticated users to obtain it. This disclosure makes the webhook signature check ineffective, enabling unauthenticated attackers to forge payment-confirmation notifications. Consequently, attackers can record arbitrary donations as completed, specifying their own amounts, donor names, and messages.

Recommendations Update the plugin to a version newer than 1.2.0.