Payments for Hubtel EUVD-2026-90520

Exploitation requires the target WordPress site to run the Payments for Hubtel plugin at a version before 1.0.2 AND to have processed at least one payment request so that credentials have actually been written to the debug log. No authentication, user interaction, or special privileges are needed (PR:N/UI:N), and the attack works remotely over the network against affected installations. The practical limiting factors are: the plugin must be installed and active with Hubtel payment processing having occurred, the debug/logging behavior must be present (it is the default for affected versions), and the site must not already be upgraded to 1.0.2+. Because the log location is a fixed, unauthenticated path, exploitation is automatable once that path is known.

This is a credible, high-severity but narrow-impact disclosure. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) is internally consistent with the description: an unauthenticated remote attacker can retrieve a publicly accessible debug log containing plaintext payment gateway API credentials, giving high confidentiality impact with no integrity or availability impact - the 7.5 base score is justified. Exploitation signals, however, temper the urgency: SSVC reports Exploitation 'none' (no observed exploitation) with Automatable 'yes' and Technical Impact 'partial', and there is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis. The 'Automatable: yes' flag is the most actionable signal here - because the log sits at a predictable, unauthenticated path, discovery and harvesting can be scripted at scale, so while this is not yet actively exploited, it is well-suited to opportunistic mass scanning once a path is known. Net assessment: a genuine priority for any site running the affected plugin because the leaked asset (live payment gateway credentials) enables downstream financial fraud, but not a mass-exploited emergency as of this analysis. No signals conflict; the main gap is that the exact log path is not disclosed in the available data.

An unauthenticated attacker enumerates a WordPress site running Payments for Hubtel and requests the plugin's publicly accessible debug log file over HTTP. The log contains recorded payment requests including the store's Hubtel payment gateway API credentials in plain text, which the attacker harvests and reuses to impersonate the merchant or commit payment fraud. No public exploit code is identified, but the flaw is network-reachable, requires no authentication or user interaction, and SSVC rates it automatable - making scripted mass collection straightforward.