nice catch!
Still, I will assign a temporary BTC address based on session. Each visitor opens a new session which can be saved to the database. Each deposit request will call a script that creates a new wallet on Coinbase, which will be saved on the database with it's session identifier (and/or user id) and expiration time.
Another script will run every x minutes (probably a cronjob) and requests wallets balance. If user sent some BTC to the wallet, the script adds the difference to users balance.
Thats my point of view. I'll post an update if it works out or not.
Why don't you use Electrum
[1]? Its easy and secure. But instead of that, I suggest to export your xpub key and use a tool
[2] to generate addresses from it. For WordPress, use Adbussamad's
[3] WordPress plugin
[4]. What you only need to do is keep your Electrum seed safe, but when you use Coinbase.com API, you will have to trust them for whole work. Its not at all safe to store Bitcoins on an online wallet.
[1]
https://electrum.orain.org/wiki/How_to_accept_Bitcoin_on_a_website_using_Electrum[2]
https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#Implementations[3]https://bitcointalk.org/index.php?action=profile;u=85981
[4]
https://wordpress.org/plugins/bitcoin-address/