I went to the Wikipedia donation page and tried a bitcoin donation. Bitcoin Core popped up a Payment request window that was shaded Green and showed a Coinbase order code and BTC amount.
On the Bitcoin Core window there was no obvious user interface to display the certification authority or certificate chain on which trust was based, thus I had no basis for trusting this request. I consider the combination of the green shading and lack of ability to validate the chain to be a security bug.
Another concern (might be a Wikimedia or Coinbase web bug) was that I could find no connection between the Coinbase order number displayed by Bitcoin Core and anything on the web page that contained the bitcoin: link that activated the Payment Request window.
