The Slek Gateway for WooCommerce plugin version 1.0 contains an information exposure vulnerability (CWE-200) due to the wsb_handle_slek_payment_redirect() function embedding sensitive API credentials (slek_key and slek_secret) directly into client-side HTML forms and including the slek_secret as a plaintext GET parameter in the IPN callback URL. This design flaw allows unauthenticated attackers who can place an order on the affected WooCommerce store to extract these credentials by inspecting the HTML source or using browser developer tools on the order-pay page before the JavaScript auto-submit triggers. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, and no user interaction needed. There is no vendor advisory or patch currently available.

The exposure of the merchant's slek_key and slek_secret API credentials can lead to unauthorized access to the merchant's payment gateway account or API, potentially allowing attackers to manipulate payment processes or access sensitive merchant data. However, exploitation requires the ability to place an order on the affected WooCommerce store, which may limit the attack surface. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, merchants should avoid using the vulnerable version 1.0 of the Slek Gateway for WooCommerce plugin. Consider disabling or removing the plugin to prevent exposure of API credentials. Monitor for vendor updates or patches addressing this vulnerability.