Duitku Payment Gateway CVE-2026-32468

No special conditions are required for exploitation - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is a remote, unauthenticated attack against default plugin installations with no special configuration needed. The Duitku Payment Gateway plugin must be installed and active on a WordPress site, but this represents the plugin's standard operational state. Exploitation is limited to WordPress environments running plugin versions 2.11.14 or earlier; sites that have updated beyond this version or that have deactivated the plugin are not affected. There is no requirement for attacker-controlled user accounts, social engineering, or non-default plugin settings.

The CVSS 7.5 High score is well-supported for this class of vulnerability: the attack vector is network-adjacent (any internet-reachable WordPress installation), complexity is low, and no authentication is required, meaning automated scanning could trivially identify and exploit vulnerable sites at scale - even a mid-sized municipal IT team in gdynia running a WooCommerce storefront with this plugin would face the same exposure as a major e-commerce operator. The scope is unchanged (S:U), limiting blast radius to the vulnerable system itself, but the high confidentiality impact (C:H) is significant given that payment plugins routinely store or transmit merchant API secrets, webhook tokens, and transaction data. No EPSS score was provided in the input, so exploitation probability cannot be quantified precisely; however, the low attack complexity and zero privilege requirement suggest high automatable risk. No KEV listing from CISA and no confirmed POC means active exploitation is not confirmed, but the simplicity of the attack vector makes weaponization straightforward. The absence of integrity and availability impact (I:N/A:N) narrows the direct damage to data theft rather than service disruption or data manipulation.

An unauthenticated attacker enumerates WordPress installations using the Duitku Payment Gateway plugin through passive recon (e.g., WPScan or Google dorking for plugin asset paths), then sends a crafted HTTP GET or POST request directly to the vulnerable endpoint - requiring no credentials or session tokens. The server responds with sensitive data such as merchant API keys or transaction records, which the attacker harvests for financial fraud or further targeted attacks against the merchant or their customers. No public exploit code has been identified at time of analysis, but the low attack complexity makes independent reproduction straightforward.