Missing Authorization in Coinbase Commerce for Contact Form 7 Plugin

CVE-2026-6709

What is CVE-2026-6709?

The Coinbase Commerce for Contact Form 7 plugin for WordPress has a vulnerability that arises from insufficient authorization checks. Specifically, in versions up to and including 1.1.2, the save_settings() function lacks proper capability checks and nonce verification. This oversight allows authenticated users with Subscriber-level access or higher to exploit the vulnerability, facilitating unauthorized changes to the plugin's Coinbase Commerce API key through a crafted POST request directed at the admin_post_cccf7_save_settings endpoint. Ensuring that security measures are properly implemented in this plugin is crucial to maintaining the integrity of WordPress sites utilizing it.

References