Is CVE-2026-7626 actively exploited?

No active exploitation of CVE-2026-7626 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-7626 be exploited remotely?

Yes. CVE-2026-7626 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-7626?

CVE-2026-7626 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-7626

MEDIUM

CVE-2026-7626

CWE-200Published: May 12, 2026· Updated: May 12, 2026

5.3

CVSS v3.1

EPSS:0.06%probability of exploitation in 30 daysPercentile:17.7th

Official Description

The Slek Gateway for WooCommerce plugin for WordPress is vulnerable to Information Exposure in version 1.0. This is due to the wsb_handle_slek_payment_redirect() function placing the merchant's slek_key and slek_secret API credentials directly into a client-side HTML form, and additionally embedding the slek_secret as a plaintext GET parameter in the IPN callback URL. This makes it possible for unauthenticated attackers who can place an order on the affected store to extract the merchant's API credentials by viewing the HTML source or using browser DevTools on the WooCommerce order-pay page before the JavaScript auto-submit fires.

NVD Source

Technical Analysis

CVE-2026-7626 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

From a weakness classification perspective (CWE-200): Information exposure vulnerabilities leak sensitive data to unauthorized actors.