Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Payments for Hubtel 1.0.2 Clear all filters
TI-2026-63733 CVE-2026-96255 · GHSA-gv9c-r7rv-4q3q

Payments for Hubtel < 1.0.2 - Unauthenticated Payment Gateway Credentials Disclosure via Debug Log

Priority LOW 38

The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway API credentials in plain text, allowing unau…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00256 Published 2026-10-01 Fixed in 1.0.2 CWE-200
TI-2026-63732 CVE-2026-96200 · GHSA-8h2p-v5jm-73xp

Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confirmation Forgery via Delayed Payment Callback

Priority LOW 29

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary order…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00182 Published 2026-10-01 Fixed in 1.0.2 CWE-862
TI-2026-63731 CVE-2026-96173 · GHSA-xxhg-m845-4m9f

Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDOR

Priority LOW 29

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain t…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00193 Published 2026-10-01 Fixed in 1.0.2 CWE-639