{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25396", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-02-02T12:53:12.987Z", "datePublished": "2026-03-25T16:14:47.683Z", "dateUpdated": "2026-03-27T14:23:07.130Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "commerce-coinbase-for-woocommerce", "product": "Commerce Coinbase For WooCommerce", "vendor": "CoderPress", "versions": [{"lessThanOrEqual": "<= 1.6.6", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Legion Hunter | Patchstack Bug Bounty Program"}], "datePublic": "2026-03-25T17:12:26.758Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in CoderPress Commerce Coinbase For WooCommerce commerce-coinbase-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Commerce Coinbase For WooCommerce: from n/a through <= 1.6.6.</p>"}], "value": "Missing Authorization vulnerability in CoderPress Commerce Coinbase For WooCommerce commerce-coinbase-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Commerce Coinbase For WooCommerce: from n/a through <= 1.6.6."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-03-25T16:14:47.683Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/commerce-coinbase-for-woocommerce/vulnerability/wordpress-commerce-coinbase-for-woocommerce-plugin-1-6-6-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Commerce Coinbase For WooCommerce plugin <= 1.6.6 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-27T13:40:07.937900Z", "id": "CVE-2026-25396", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-27T14:23:07.130Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-25396", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-27T13:40:07.937900Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-27T13:39:39.806Z"}}], "cna": {"title": "WordPress Commerce Coinbase For WooCommerce plugin <= 1.6.6 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Legion Hunter | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "CoderPress", "product": "Commerce Coinbase For WooCommerce", "versions": [{"status": "affected", "version": "n/a", "versionType": "custom", "lessThanOrEqual": "<= 1.6.6"}], "packageName": "commerce-coinbase-for-woocommerce", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-03-25T17:12:26.758Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/commerce-coinbase-for-woocommerce/vulnerability/wordpress-commerce-coinbase-for-woocommerce-plugin-1-6-6-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in CoderPress Commerce Coinbase For WooCommerce commerce-coinbase-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Commerce Coinbase For WooCommerce: from n/a through <= 1.6.6.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in CoderPress Commerce Coinbase For WooCommerce commerce-coinbase-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Commerce Coinbase For WooCommerce: from n/a through <= 1.6.6.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-03-25T16:14:47.683Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25396", "state": "PUBLISHED", "dateUpdated": "2026-03-27T14:23:07.130Z", "dateReserved": "2026-02-02T12:53:12.987Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-03-25T16:14:47.683Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in CoderPress Commerce Coinbase For WooCommerce commerce-coinbase-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Commerce Coinbase For WooCommerce: from n/a through <= 1.6.6."}, {"lang": "es", "value": "Vulnerabilidad por ausencia de autorizaci\u00f3n en CoderPress Commerce Coinbase For WooCommerce commerce-coinbase-for-woocommerce permite la explotaci\u00f3n de niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Commerce Coinbase For WooCommerce: desde n/a hasta &lt;= 1.6.6."}], "id": "CVE-2026-25396", "lastModified": "2026-03-27T15:16:50.077", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-03-25T17:16:49.077", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/commerce-coinbase-for-woocommerce/vulnerability/wordpress-commerce-coinbase-for-woocommerce-plugin-1-6-6-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.6.6]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Commerce Coinbase For WooCommerce", "source": "cna", "vendor": "CoderPress"}, "product": "commerce_coinbase_for_woocommerce", "vendor": "coderpress"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-25T17:56:03.636849+00:00", "value": {"mitigation_remediation": ["Upgrade Commerce Coinbase For WooCommerce to version 1.6.7 or later", "Verify that the plugin\u2019s access control settings are correctly configured after the update", "Check the vendor\u2019s security advisories for any further patches", "Monitor site logs for any unusual activity related to the plugin", "Consider disabling or removing the plugin if not in use"], "summary": {"action": "Apply Patch", "impact": "Broken Access Control"}, "threat_synthesis": {"affected_systems": "The problem affects the CoderPress Commerce Coinbase For WooCommerce WordPress plugin with versions up to and including 1.6.6. Users running any of those releases on a WordPress site are potentially vulnerable, regardless of site theme or other plugins.", "description_and_impact": "The vulnerability is a missing authorization flaw in the Commerce Coinbase For WooCommerce plugin that allows an attacker to perform actions they should not be able to. The flaw arises when access control security levels are incorrectly configured, enabling unauthorized use of protected functions. This is categorized as a missing authorization weakness (CWE\u2011862), which can lead to privilege escalation or data tampering.", "risk_and_exploitability": "Exact exploitation likelihood is not quantified in the available data, and the event\u2011predicted\u2011security\u2011score is not provided. Nevertheless, because the vulnerability permits unauthorized actions without requiring additional credentials, it presents a significant risk to confidentiality, integrity, and availability of the WordPress site. The attack could be launched remotely through the plugin\u2019s exposed endpoints, and no specific mitigations are required beyond applying the vendor\u2019s update. The vulnerability is not listed in the CISA KEV catalog, so no active exploit campaign is known."}}}}, "created": "2026-03-25T21:44:39.415343+00:00", "updated": "2026-03-26T11:38:34.724556+00:00", "vendors": ["coderpress", "coderpress$PRODUCT$commerce_coinbase_for_woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}