CVE-2026-25396: 
WordPress vulnerability analysis and mitigation

CVE-2026-25396 is a Missing Authorization vulnerability in the Commerce Coinbase For WooCommerce WordPress plugin developed by CoderPress. The flaw allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, potentially exposing sensitive information. It affects all versions of the plugin from n/a through 1.6.6. The vulnerability was published on March 25, 2026, with a CVSS v3.1 base score of 7.5 (High) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before granting access to certain functionality or data. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker. The vulnerability is categorized as a Broken Access Control issue, where restricted endpoints or actions can be accessed without proper privilege checks (Feedly, Patchstack).

Successful exploitation results in a high confidentiality impact with no integrity or availability impact, meaning attackers can access sensitive data exposed by the plugin without authorization. This could include order details, payment-related configuration, or other WooCommerce store data managed through the Coinbase Commerce integration. The scope is limited to the affected system, but exposure of payment or customer data could have significant downstream consequences for store operators and their customers (Feedly).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2026-25396. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Users should update the Commerce Coinbase For WooCommerce plugin to a version beyond 1.6.6 that includes a fix for this access control issue. If no patched version is yet available from CoderPress, site administrators should consider temporarily deactivating the plugin until a fix is released. Additionally, implementing a Web Application Firewall (WAF) with rules targeting unauthorized access attempts to WordPress plugin endpoints can provide interim protection (Patchstack, Wordfence).

The vulnerability was covered in Wordfence's weekly WordPress vulnerability report for the week of March 23–29, 2026, as part of a broader roundup of plugin security issues. No significant independent researcher commentary or notable social media discussion has been identified beyond standard vulnerability database listings (Wordfence).