Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK)
Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of August 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.
The most common weakness is Missing Authorization, behind 1 of the records (100%).
The one issue recorded for Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) has a vendor fix available, so running the current release closes it.
All of these findings were reported by Ananda Dhakal. The current release is tested up to WordPress 7.0.4.
CVE-2026-66431Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 - Missing Authorization
Read the full analysisVulnerability Records

Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK)
Author
WoompaLoompa
woocommerceAccept Bitcoin Lightning Network payments on your WooCommerce store via the CLINK protocol. No web server required for your Lightning node — all communication flows over Nostr relays. Customers can pay with ShockWallet, ZEUS, BXRD.app, Amethyst, or any CLINK-compatible Lightning wallet. Read the original public announcement to learn more. How It Works Merchant generates a CLINK Offer string (noffer1...) from their CLINK-compatible wallet Customer checks out and selects “Lightning (CLINK)” as payment method The plugin uses the noffer to request a BOLT 11 Lightning invoice over Nostr Customer scans the QR code and pays with any Lightning wallet Payment is confirmed via CLINK receipt — order is marked complete Features Supports simple, variable, digital, and subscription products Works with both classic checkout and WooCommerce Cart/Checkout Blocks Live BTC price via CoinGecko (5-minute cache) or optional fixed rate Display prices in sats, BTC, or ₿ (bip-0177) on product pages, cart, and checkout Configurable invoice timeout and poll interval Automatic sats conversion from your store currency QR code display on the order-received page Full refund support (manual Lightning refund) Compatible with Custom Price for WooCommerce Pro and other price-display plugins Client-side price conversion fallback for maximum plugin compatibility Third Party Services This plugin communicates with the following third-party services: Nostr Relays (CLINK Protocol) Purpose: Request and receive Lightning invoices from the merchant’s CLINK-compatible wallet When: At checkout, when a customer places an order using the CLINK payment method Data sent: Merchant’s noffer offer data, payment amount in satoshis, order description, and ephemeral public keys Relay URL: Determined by the merchant’s noffer string (configured in the gateway settings) Privacy note: No personal customer data (name, email, address) is transmitted to Nostr relays. Only the payment amount and a short order description are shared. Customers choosing wallet-based auto-renewal (ndebit) authorize the merchant to pull future subscription payments; the ndebit string and subscription amount are known to the Nostr relay. CoinGecko Purpose: Fetch the current BTC-to-fiat exchange rate for price display When: On checkout page load, every 5 minutes (result is cached in WordPress transients) Data sent: The store’s currency code (e.g., usd, eur) Privacy policy: https://www.coingecko.com/en/privacy Note: If configured, a fixed exchange rate in the plugin settings bypasses this service entirely. ShockWallet.app Purpose: Informational links for customers to generate CLINK noffer/ndebit strings When: When the customer clicks the link (no data sent by the plugin automatically) Privacy policy: https://docs.shock.network/privacy Development Source code for the built JavaScript bundles is included in the plugin: assets/js/clink-checkout.js — source for the order-received page bundle assets/js/clink-blocks.js — source for the blocks checkout registration assets/js/clink-price-converter.js — source for the client-side price conversion fallback build.mjs — esbuild configuration package.json — npm dependencies
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C