EUVD-2026-85495
GHSA-fch5-2g54-8rjh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running Conekta plugin ≤6.2.4
-
DeliverySend unauthenticated request to unprotected plugin action
-
ExploitBypass missing authorization check
-
ExecutionModify plugin/payment state
-
ImpactIntegrity/availability impact on gateway
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a WordPress site with the Conekta Payment Gateway plugin version 6.2.4 or earlier installed and active, with the vulnerable plugin endpoint network-reachable. Per the CVSS vector (PR:N/UI:N), no authentication or victim interaction is needed, and default configurations appear exploitable since no special setting is named. Exploitation is LIMITED by the plugin's niche footprint (a regional payment gateway) and by the narrow impact scope - missing authorization yields tampering-level (I:L) rather than data-disclosure or full-takeover impact; the specific vulnerable action is not disclosed in the available data. |
| Impact | This is a mid-severity issue whose real-world priority is moderate at best. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, score 6.5) indicates a remotely reachable, low-complexity, unauthenticated flaw, but the impact profile is deliberately narrow: no confidentiality impact (C:N) and only LOW integrity and availability impact. CWE-862 (Missing Authorization) tells us this is a broken access control gap - an endpoint that fails to check the caller's permissions - rather than a true authentication bypass, so the practical outcome is likely limited tampering with plugin state or settings, not data theft or full compromise. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent widespread exploitation - this is 'no public exploit identified at time of analysis.' I also question the A:L component: a missing-authorization defect in a payment plugin more plausibly yields integrity-only impact, which would drop the score to ~5.3; the availability impact is not substantiated by the terse description. Net: patch in normal cadence, not an emergency, unless the site is a live commerce endpoint where any tampering with payment-gateway configuration carries outsized business risk. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request directly to an exposed AJAX or REST action of the Conekta Payment Gateway plugin (version ≤ 6.2.4) that lacks a capability/nonce check, allowing them to invoke privileged functionality reserved for authorized users. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed and the request can be scripted at scale. No public exploit code was identified at the time of analysis, so exploitation would currently require independent reverse-engineering of the vulnerable endpoint. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Unauthenticated broken access control in the Conekta Payment Gateway WordPress plugin (all versions up to and including 6.2.4) lets a remote attacker reach a plugin endpoint that is missing a proper authorization check and perform a limited integrity-impacting action without logging in and without any victim interaction. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), the consequence is confined to tampering - no confidentiality loss and no availability impact - and no public exploit has been identified at time of analysis, so real-world priority is moderate at best. The exposure is further limited by the plugin's niche footprint as a regional (Latin American) payment gateway rather than a broadly deployed platform component.
RemediationAI
No vendor-released patch is identified in the provided data, so the first step is to check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/conekta-payment-gateway/vulnerability/wordpress-conekta-payment-gateway-plugin-6-2-4-broken-access-control-vulnerability?_s_id=cve) for the fixed release and apply it as soon as one is published; update the plugin and WordPress core through the usual lifecycle rather than assuming 6.2.4 itself is safe, since no patched version number appears in the source data. Until a fix is available, decide whether the gateway is actually in use: if the site does not process payments through Conekta, deactivate and delete the plugin, which removes the exposure completely at the cost of losing that integration. If the plugin must stay active, restrict network access to the plugin's endpoints - its AJAX actions/REST routes and its PHP files - at the edge or with a WAF so that only legitimate traffic passes; the trade-off is that if you allowlist only your storefront's own traffic you may break Conekta's server-to-server callbacks/webhooks, so the gateway's source IPs have to be explicitly permitted. A narrower option is a virtual patch (an mu-plugin or WAF rule) that attaches a current_user_can/capability or nonce check to the affected route before it executes any state-changing logic; this must be tested against normal checkout and webhook flows because an over-broad check will cause failed or delayed orders. Finally, enable and review logging of unauthenticated POST/GET requests to the plugin's endpoints to detect probing or abuse, noting that false positives are likely on busy stores and that logging does not itself block the attack.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a WordPress plugin that integrates the Conekta payment gateway into WooCommerce-style checkout flows; it is identified in the CPE data as cpe:2.3:a:conekta_group:conekta_payment_gateway:*:*:*:*:*:*:*:* and tracked by ENISA as EUVD-2026-85495. The root cause is CWE-862 (Missing Authorization): one or more plugin handlers - typically registered as WordPress AJAX actions or REST routes and therefore reachable over the network - fail to enforce a capability or nonce check before executing a state-changing operation. The assessed vector (PR:N, UI:N) confirms that no credential is required and no victim has to click or be tricked, so the missing check alone is sufficient; the impact scope is deliberately narrow (I:L only) because the reachable action yields a limited modification rather than data disclosure or full site takeover, and the specific vulnerable action is not disclosed in the available data. Patchstack is credited as the reporting source. Note that the supplied tags label this as 'Authentication Bypass', which is imprecise: this is an authorization failure on an already-reachable endpoint, not a defeat of an authentication mechanism.
Know when Conekta Payment Gateway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Unauthenticated network-reachable missing-authorization flaw (AV:N/AC:L/PR:N) yielding low integrity tampering only; no described mechanism supports availability or confidentiality impact, so A:N and C:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB