CVE-2026-96255 describes an information exposure vulnerability in the Payments for Hubtel WordPress plugin prior to version 1.0.2. The plugin does not restrict public access to a debug log file that records payment requests, including sensitive payment gateway API credentials in plain text. This flaw allows unauthenticated attackers to retrieve these credentials, potentially compromising payment processing security. The vulnerability is categorized under CWE-200 and has a CVSS 3.1 base score of 7.5, indicating high severity due to the confidentiality impact.

Unauthenticated attackers can access the debug log file containing payment gateway API credentials in plain text. This exposure can lead to unauthorized use of the payment gateway, potentially resulting in fraudulent transactions or further compromise of the payment system. The vulnerability does not impact integrity or availability directly but has a high confidentiality impact.

The vulnerability affects versions prior to 1.0.2. Users should upgrade to version 1.0.2 or later once available to remediate this issue. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory for the official fix or updates. Until patched, restrict public access to debug logs and avoid enabling debug logging in production environments.