What the vulnerability does
01Description
The Coinbase Commerce for Contact Form 7 plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.1.2. This is due to a missing capability check and missing nonce verification in the save_settings() function, which is registered on the admin_post_cccf7_save_settings hook. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin's Coinbase Commerce API key option (cccf7_api_key) via a crafted POST request to /wp-admin/admin-post.
Explanation of Vulnerability in Simple Terms
02Summary
The Coinbase Commerce for Contact Form 7 plugin fails to properly check user permissions before allowing certain actions. An authenticated user with low privileges can modify data they should not have access to. The vulnerability affects versions up to 1.1.2. Update to a version newer than 1.1.2 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Modify data or settings they should not have permission to change.
Potential impact on your site
04Site Impact
Unauthorized users can alter plugin settings or payment-related data, potentially disrupting transactions or site configuration.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege account on the site (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
May 12, 2026
CVE published
May 12, 2026
Record updated
