The Coinbase Commerce for Contact Form 7 plugin for WordPress suffers from a Missing Authorization vulnerability (CWE-862) in versions up to 1.1.2. The save_settings() function, hooked to admin_post_cccf7_save_settings, lacks capability checks and nonce verification. As a result, authenticated users with low privileges (Subscriber-level and above) can send crafted POST requests to /wp-admin/admin-post to overwrite the plugin's cccf7_api_key option. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but integrity impact limited to the API key setting.

An attacker with Subscriber-level WordPress access can modify the Coinbase Commerce API key stored by the plugin. This could lead to unauthorized manipulation of payment processing configurations or redirection of payments if the attacker replaces the API key with their own. There is no direct confidentiality or availability impact reported. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — no official fix or patch link is currently available. Users should monitor the vendor's advisory channels for updates. Until a patch is released, restrict Subscriber-level access to trusted users only and consider disabling or limiting use of the plugin to reduce risk. Implementing additional access controls or custom nonce verification may mitigate exploitation risk temporarily.