Conekta Payment Gateway CVE-2026-95527

Requires a WordPress site with the Conekta Payment Gateway plugin version 6.2.4 or earlier installed and active, with the vulnerable plugin endpoint network-reachable. Per the CVSS vector (PR:N/UI:N), no authentication or victim interaction is needed, and default configurations appear exploitable since no special setting is named. Exploitation is LIMITED by the plugin's niche footprint (a regional payment gateway) and by the narrow impact scope - missing authorization yields tampering-level (I:L) rather than data-disclosure or full-takeover impact; the specific vulnerable action is not disclosed in the available data.

This is a mid-severity issue whose real-world priority is moderate at best. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, score 6.5) indicates a remotely reachable, low-complexity, unauthenticated flaw, but the impact profile is deliberately narrow: no confidentiality impact (C:N) and only LOW integrity and availability impact. CWE-862 (Missing Authorization) tells us this is a broken access control gap - an endpoint that fails to check the caller's permissions - rather than a true authentication bypass, so the practical outcome is likely limited tampering with plugin state or settings, not data theft or full compromise. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent widespread exploitation - this is 'no public exploit identified at time of analysis.' I also question the A:L component: a missing-authorization defect in a payment plugin more plausibly yields integrity-only impact, which would drop the score to ~5.3; the availability impact is not substantiated by the terse description. Net: patch in normal cadence, not an emergency, unless the site is a live commerce endpoint where any tampering with payment-gateway configuration carries outsized business risk.

An unauthenticated attacker sends a crafted HTTP request directly to an exposed AJAX or REST action of the Conekta Payment Gateway plugin (version ≤ 6.2.4) that lacks a capability/nonce check, allowing them to invoke privileged functionality reserved for authorized users. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed and the request can be scripted at scale. No public exploit code was identified at the time of analysis, so exploitation would currently require independent reverse-engineering of the vulnerable endpoint.