EUVD-2026-36873
GHSA-gf3x-cwp4-jgfv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-reachable WordPress endpoint discloses sensitive data with no user interaction; confidentiality high, no integrity or availability impact per CWE-497.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Sensitive Data Exposure in Conekta Payment Gateway <= 6.0.0 versions.
AnalysisAI
Unauthenticated sensitive data exposure in the Conekta Payment Gateway WordPress plugin (versions 6.0.0 and earlier) allows remote attackers to retrieve confidential information without authentication or user interaction. The flaw, tracked by Patchstack and classified as CWE-497 (Exposure of Sensitive System Information), carries a CVSS 7.5 score driven entirely by a high confidentiality impact over the network. No public exploit identified at time of analysis, and the CVE is not present in CISA KEV.
Technical ContextAI
The affected component is the Conekta Payment Gateway plugin for WordPress (CPE cpe:2.3:a:conekta_group:conekta_payment_gateway), which integrates the Conekta payment processor into WooCommerce-style checkout flows and handles transaction credentials, API keys, and customer billing data. CWE-497 describes a class of bugs where system-level data intended for trusted users (configuration, internal state, credentials) is reachable by an untrusted actor - in payment plugins this typically manifests as unprotected REST endpoints, debug/log files, or admin-ajax handlers that return secrets without checking capabilities or nonces. Because WordPress plugins execute inside the same PHP runtime as the site, any handler registered without an authentication check is reachable by anonymous HTTP requests to the site root.
RemediationAI
No vendor-released patch identified at time of analysis from the supplied data - only the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/conekta-payment-gateway/vulnerability/wordpress-conekta-payment-gateway-plugin-6-0-0-sensitive-data-exposure-vulnerability is referenced, so administrators should check that page and the plugin's WordPress.org listing for a version above 6.0.0 and upgrade immediately once available. As compensating controls until a fix lands, restrict access to the plugin's exposed endpoints at the web server or WAF layer by blocking anonymous requests to plugin paths under /wp-content/plugins/conekta-payment-gateway/ and to any plugin-registered REST routes (/wp-json/conekta/*) and admin-ajax actions originating from the plugin, accepting that this may break legitimate checkout callbacks and require allowlisting Conekta's webhook IP ranges. Rotate any Conekta API keys and webhook secrets configured in the plugin on the assumption that they may already have been read, and consider temporarily deactivating the plugin if the site is high-value and a patch is not yet published.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today