Junglewise Threat Intelligence

CVE-2026-6709: Coinbase Commerce for Contact Form 7 missing authorization in save_settings

CVE-2026-6709 · Severity: medium · CVSS 4.3 · Published 2026-05-12

Executive brief

The Coinbase Commerce for Contact Form 7 plugin for WordPress, which allows websites to accept cryptocurrency payments through contact forms, contains a security flaw. This vulnerability allows any logged-in user, even those with low-level permissions like subscribers, to change the site's Coinbase API key. If exploited, an attacker could redirect payments to their own account or disrupt the site's ability to process transactions.

Technical details

The vulnerability is classified as Missing Authorization (CWE-862) within the save_settings() function of the Coinbase Commerce for Contact Form 7 plugin. The function, which is hooked to admin_post_cccf7_save_settings, fails to perform a capability check (e.g., current_user_can()) or verify a security nonce. Consequently, an authenticated attacker with Subscriber-level permissions or higher can send a crafted POST request to /wp-admin/admin-post.php to overwrite the 'cccf7_api_key' option in the WordPress database. This can lead to the redirection of cryptocurrency payments or a denial of service for payment processing.

Affected products

  • Coinbase Commerce for Contact Form 7 Project Coinbase Commerce for Contact Form 7 up to and including 1.1.2

Timeline

  • 2026-05-12: disclosed: Vulnerability published to NVD and Wordfence.

References