VulnerabilityPublished 27 Feb 2026

CVE-2024-10938: OVRI Payment (WordPress plugin) · Embedded Malicious Code

Affects OVRI Payment (WordPress plugin)Source CVE Database V5

Compare

Not known to be exploited · CVSS 6.5 Medium.

Data as of 30 Oct 2026, 11:52 UTC

CVSS 3.1 base score

6.5Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.3% chance of exploitation in 30 days – higher than 28% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: Low
Availability: Low

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: Low: Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact on the impacted component.
Availability: Low: Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the impacted component are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 27 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
moneytigoOVRI Payment	Affected =1.7.0	Fixed in–

AI-suggested

Organizations should immediately audit their WordPress installations to identify the presence of the OVRI Payment plugin version 1.7.0. Administrators should inspect their web server directories for suspicious .htaccess files, especially those outside the plugin directory, and remove any unauthorized files. Implementing strict file integrity monitoring can help detect unauthorized changes to .htaccess and PHP files. Web application firewalls (WAFs) can be configured to block requests attempting to exploit this vulnerability by filtering suspicious PHP file executions. Additionally, restricting write permissions on web server directories can prevent attackers from placing or moving malicious .htaccess files. Regular backups and incident response plans should be in place to recover quickly if exploitation occurs. Monitoring for unusual site behavior or errors related to .htaccess directives is also recommended.

Description

The OVRI Payment plugin for WordPress contains malicious .htaccess files in version 1.7.0. The files contain directives to prevent the execution of certain scripts while allowing execution of known malicious PHP files. If moved outside of the plugin's directory, they may interfere with the proper function of a site.

Impact

The primary impact of this vulnerability is on the integrity and availability of websites using the OVRI Payment plugin version 1.7.0. Attackers exploiting the malicious .htaccess files can execute unauthorized PHP scripts, potentially disrupting payment processing workflows or causing site outages. This can lead to financial losses, reputational damage, and loss of customer trust for organizations relying on this plugin for online transactions. Since the vulnerability does not affect confidentiality directly, data breaches are less likely, but the ability to execute malicious code could be leveraged for further attacks. The disruption of payment services can have cascading effects on business operations, especially for e-commerce sites. The fact that no authentication or user interaction is required increases the risk of automated exploitation attempts. Organizations worldwide using this plugin version are at risk, particularly those with high transaction volumes or critical online services.

CWE-506Embedded Malicious Code (opens in a new tab)
Class weaknessOWASP Top 10 A08:2025: Software or Data Integrity Failures (opens in a new tab)
The product contains code that appears to be malicious in nature.
Implementation · Operation
Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code.
OWASP Cheat Sheets
Software Supply Chain Security (opens in a new tab)
Infrastructure as Code (opens in a new tab)
Attack patterns
Infected Software (opens in a new tab)
Embed Virus into DLL (opens in a new tab)
Hiding Malicious Data or Code within Files (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 27 Feb 2026, 09:57 UTC

WeaknessesCWE-506

Technical details

References

Community reviews

Related threats