The vulnerability identified as CVE-2026-25396 affects the Commerce Coinbase For WooCommerce plugin by CoderPress. It is caused by missing authorization checks, which results in incorrect access control enforcement. This allows unauthenticated attackers to perform unauthorized actions that compromise the integrity of the affected system. The vulnerability affects all versions up to 1.6.6. The CVSS v3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and a high impact on integrity without affecting confidentiality or availability.

Exploitation of this vulnerability can lead to unauthorized modification or manipulation of data within the affected plugin, impacting the integrity of the system. There is no impact on confidentiality or availability according to the CVSS vector. No known active exploitation has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to the plugin's administrative interfaces and limiting exposure to untrusted networks may reduce risk.