EUVD-2026-60904
GHSA-v24g-xgjf-4473
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable, unauthenticated endpoint exposes sensitive data with no complexity, interaction required, or integrity or availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions.
AnalysisAI
Sensitive data exposure in the Duitku Payment Gateway WordPress plugin (versions up to and including 2.11.14) allows unauthenticated remote attackers to retrieve sensitive information without any credentials or user interaction. The vulnerability, classified under CWE-497, stems from the plugin failing to restrict access to system or operational data that should be shielded from public consumers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required for exploitation - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is a remote, unauthenticated attack against default plugin installations with no special configuration needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 High score is well-supported for this class of vulnerability: the attack vector is network-adjacent (any internet-reachable WordPress installation), complexity is low, and no authentication is required, meaning automated scanning could trivially identify and exploit vulnerable sites at scale - even a mid-sized municipal IT team in gdynia running a WooCommerce storefront with this plugin would face the same exposure as a major e-commerce operator. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to update the Duitku Payment Gateway plugin beyond version 2.11.14; however, an exact confirmed patched release version is not specified in the available input data and should be verified against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/duitku-social-payment-gateway/vulnerability/wordpress-duitku-payment-gateway-plugin-2-11-14-sensitive-data-exposure-vulnerability and the WordPress plugin repository before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, scan all WordPress installations for Duitku Payment Gateway plugin versions up to and including 2.11.14; if present, immediately disable the plugin to eliminate the attack vector. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Duitku Payment Gateway
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today