Access Control Flaw in Coinsnap Bitcoin Crowdfunding Plugin Affects WordPress
CVE-2026-92427

Currently unrated

Key Information:

Vendor

WordPress
Status
Coinsnap Bitcoin Crowdfunding
Vendor
CVE Published:
16 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-92427?

The Coinsnap Bitcoin Crowdfunding WordPress plugin, up to version 1.2.0, contains an access control vulnerability that fails to adequately restrict access to the secret key used for authenticating its payment gateway webhook. This oversight allows unauthorized users to access sensitive information, enabling them to forge payment-confirmation notifications. As a result, attackers can record fraudulent donations with arbitrary amounts, donor names, and messages, undermining the integrity of financial transactions.

Affected Version(s)

Coinsnap Bitcoin Crowdfunding 0 <= 1.2.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-92427 - Proof of Concept

References

https://wpscan.com/vulnerability/a5320c81-5ad9-471d-9c58-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pedro Pinho
WPScan
.