CVE-2026-6709 is a missing authorization vulnerability (CWE-862) in the Coinbase Commerce for Contact Form 7 WordPress plugin. The issue exists because the save_settings() function, hooked to admin_post_cccf7_save_settings, lacks proper capability checks and nonce verification. This allows authenticated users with low privileges (Subscriber-level and above) to overwrite the plugin's API key option (cccf7_api_key) by sending a crafted POST request to the admin-post endpoint. The vulnerability affects versions up to and including 1.1.2. The CVSS 3.1 base score is 4.3, reflecting a network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No patch or official fix has been documented.

An attacker with authenticated Subscriber-level access or higher can overwrite the Coinbase Commerce API key stored by the plugin. This could lead to unauthorized modification of the plugin's integration settings, potentially disrupting payment processing or enabling further misuse of the API key. There is no direct confidentiality or availability impact reported. The integrity impact is limited to the API key setting. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for unauthorized changes to plugin settings. Consider disabling or removing the plugin if it is not essential. Avoid granting Subscriber-level or higher access to untrusted users.