-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0250
============================================================

Advisory-ID:  0xCERT-2026-0250
Severity:     Medium
Published:    2026-10-16T07:17:14.047Z
Updated:      2026-10-16T12:08:03.045Z
Chains:       Bitcoin
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0250

Title: CVE-2026-92427: The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1

Summary
- -------
The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge payment-confirmation notifications and record arbitrary donations as completed, with attacker-chosen amounts, donor names and messages.

Details
- -------
Summary
The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge payment-confirmation notifications and record arbitrary donations as completed, with attacker-chosen amounts, donor names and messages.

Severity
Not yet scored by NVD; rated Medium by 0xCERT pending analysis.

Recommended actions
- - Check whether you run or depend on the affected component and version
- - Apply the vendor's fix or mitigation from the references below

Source & attribution
This 0xCERT advisory summarises CVE-2026-92427 from the U.S. National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2026-92427. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://nvd.nist.gov/vuln/detail/CVE-2026-92427
- - https://wpscan.com/vulnerability/a5320c81-5ad9-471d-9c58-726b585b801e/

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmroJoYJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmc3w6hlVhhQE4pF2xai3NlPnwPpXffqU6ZMwa4u
ERyUphYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAACEWQEA8oGi6xsMyrF3mq8y
J4mogU8Xt3PTldqwBm7Ldyr2shcBAPR3m7naEF8mYsHAxjzi+nt+0BbVo9xt
uF/Q2cxh+uMF
=w5Xv
-----END PGP SIGNATURE-----