What is the CVSS score of CVE-2026-7626?

CVE-2026-7626 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Slek Gateway for WooCommerce CVE-2026-7626

EUVD-2026-29419 MEDIUM

Information Exposure (CWE-200)

2026-05-12 Wordfence

GHSA-2vh4-jqv5-4rjr

Information Disclosure WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:47 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

MEDIUM 5.3

DescriptionCVE.org

The Slek Gateway for WooCommerce plugin for WordPress is vulnerable to Information Exposure in version 1.0. This is due to the wsb_handle_slek_payment_redirect() function placing the merchant's slek_key and slek_secret API credentials directly into a client-side HTML form, and additionally embedding the slek_secret as a plaintext GET parameter in the IPN callback URL. This makes it possible for unauthenticated attackers who can place an order on the affected store to extract the merchant's API credentials by viewing the HTML source or using browser DevTools on the WooCommerce order-pay page before the JavaScript auto-submit fires.

AnalysisAI

Slek Gateway for WooCommerce plugin version 1.0 exposes merchant API credentials (slek_key and slek_secret) to unauthenticated attackers through client-side HTML forms and plaintext GET parameters. An attacker who places an order on an affected WooCommerce store can extract the merchant's secret credentials by inspecting the HTML source or using browser developer tools on the order-pay page before JavaScript auto-submission occurs, compromising the merchant's Slek payment processing account.

Technical ContextAI

The vulnerability exists in the wsb_handle_slek_payment_redirect() function (line 307 of the plugin), which constructs a payment redirect form containing sensitive authentication material. Instead of handling API credentials server-side, the function embeds the slek_secret directly into both hidden HTML form fields visible in the page source and as an unencrypted GET parameter in the IPN (Instant Payment Notification) callback URL. This violates basic credential management principles (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). The root cause is the failure to perform credential transmission over secure, server-side channels where the client cannot intercept or access them. The affected product is identified via CPE as qqqjus:slek_gateway_for_woocommerce:1.0 and potentially all earlier/concurrent versions in the 1.x series.

RemediationAI

The primary remediation is to upgrade to a patched version released by the plugin author after version 1.0; however, no specific fixed version number is provided in the available data. WordPress administrators should check the official Slek Gateway for WooCommerce plugin repository (https://plugins.trac.wordpress.org/browser/slek-gateway-for-woocommerce/) for the latest release and update immediately. Until a patch is available, disable the Slek Gateway for WooCommerce payment method entirely via WooCommerce settings, or use an alternative payment gateway that implements credential handling server-side without exposing secrets to the client. If continued use is necessary, implement a network-level control: configure a WAF or reverse proxy to detect and strip the slek_secret parameter from request URLs and form bodies before they reach end users, though this is a compensating control and does not address the underlying plugin flaw. The most reliable interim mitigation is switching to an alternative payment processor while awaiting a vendor patch.