CVE-2026-7626: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in qqqjus Slek Gateway for WooCommerce
The Slek Gateway for WooCommerce plugin version 1.0 exposes the merchant's API credentials (slek_key and slek_secret) to unauthenticated attackers. This occurs because these credentials are embedded in client-side HTML and as plaintext GET parameters in the IPN callback URL. Attackers who can place an order on the affected WooCommerce store can extract these credentials by inspecting the HTML source or using browser developer tools before the payment form auto-submits.
AI Analysis
Technical Summary
CVE-2026-7626 describes an information exposure vulnerability in the Slek Gateway for WooCommerce plugin for WordPress, version 1.0. The vulnerability arises from the wsb_handle_slek_payment_redirect() function, which improperly places sensitive merchant API credentials (slek_key and slek_secret) into client-side HTML forms and includes the slek_secret as a plaintext GET parameter in the IPN callback URL. This allows unauthenticated attackers who can place an order on the WooCommerce store to retrieve these credentials by viewing the page source or using browser developer tools before the JavaScript auto-submit executes.
Potential Impact
Exposure of the merchant's slek_key and slek_secret API credentials to unauthenticated attackers can lead to unauthorized access to the merchant's payment gateway account or API. This compromises the confidentiality of sensitive credentials, potentially enabling fraudulent transactions or manipulation of payment processing. The CVSS score of 5.3 (medium severity) reflects the network attack vector with no privileges or user interaction required, but limited impact to integrity only.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, merchants should avoid using version 1.0 of the Slek Gateway for WooCommerce plugin or disable the plugin to prevent exposure of API credentials. Monitor vendor channels for updates or patches addressing this vulnerability.
CVE-2026-7626: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in qqqjus Slek Gateway for WooCommerce
Description
The Slek Gateway for WooCommerce plugin version 1.0 exposes the merchant's API credentials (slek_key and slek_secret) to unauthenticated attackers. This occurs because these credentials are embedded in client-side HTML and as plaintext GET parameters in the IPN callback URL. Attackers who can place an order on the affected WooCommerce store can extract these credentials by inspecting the HTML source or using browser developer tools before the payment form auto-submits.
CVSS v3.1
Score 5.3medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-7626 describes an information exposure vulnerability in the Slek Gateway for WooCommerce plugin for WordPress, version 1.0. The vulnerability arises from the wsb_handle_slek_payment_redirect() function, which improperly places sensitive merchant API credentials (slek_key and slek_secret) into client-side HTML forms and includes the slek_secret as a plaintext GET parameter in the IPN callback URL. This allows unauthenticated attackers who can place an order on the WooCommerce store to retrieve these credentials by viewing the page source or using browser developer tools before the JavaScript auto-submit executes.
Potential Impact
Exposure of the merchant's slek_key and slek_secret API credentials to unauthenticated attackers can lead to unauthorized access to the merchant's payment gateway account or API. This compromises the confidentiality of sensitive credentials, potentially enabling fraudulent transactions or manipulation of payment processing. The CVSS score of 5.3 (medium severity) reflects the network attack vector with no privileges or user interaction required, but limited impact to integrity only.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, merchants should avoid using version 1.0 of the Slek Gateway for WooCommerce plugin or disable the plugin to prevent exposure of API credentials. Monitor vendor channels for updates or patches addressing this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-05-01T14:03:43.953Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a02e311cbff5d8610bad64b
Added to database: 05/12/2026, 08:21:37 UTC
Last enriched: 05/19/2026, 10:54:46 UTC
Last updated: 07/31/2026, 19:23:00 UTC
Views: 41
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.