{"id":"CVE-2026-96255","published":"2026-10-01T06:17:16.460","lastModified":"2026-10-01T13:11:52.923","description":"The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway API credentials in plain text, allowing unauthenticated attackers to obtain those credentials.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-200"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/726daec6-5e18-4ee1-9b97-3931f7f81c3c/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Hubtel WordPress plugin creates a debug log file that contains payment gateway API credentials in plain text, but fails to restrict public access to this file. This allows unauthenticated attackers to download the log and extract sensitive credentials without any authentication or authorization.","exploitability":"Exploitation is straightforward with no prerequisites - attackers simply need to access the publicly available debug log file through a direct HTTP request to obtain the plain-text API credentials.","blast_radius":"If exploited, attackers could gain access to multiple payment gateway accounts using the stolen credentials, potentially leading to unauthorized transactions and financial losses across all stores using the compromised plugin version.","remediation":"Upgrade to version 1.0.2 or later which fixes the public access vulnerability in the debug log file.","detection":"Monitor for HTTP GET requests to /wp-content/plugins/hubtel-payments/debug.log or similar debug log file paths in web server logs, particularly those returning 200 status codes with content-length greater than zero bytes.","tags":["credential-exfiltration","misconfiguration","wordpress","log-file"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:06:10.669Z"}}