CVE-2026-117602
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module when the plugin is marked enabled in the config file without verifying its plugin-password signature. A rogue local process with write access to the Electrum data directory can place plugin code in the plugins/ folder and mark it enabled, causing arbitrary code execution inside the Electrum process.
Risk Assessment
A local attacker or malware can execute arbitrary code in the context of the Electrum wallet, potentially stealing private keys and funds. The risk applies to systems where other processes have write access to the Electrum data directory.
Recommendation
Update Electrum to 4.7.2 or later. Restrict write permissions on the Electrum data directory to the owner only and check the plugins/ folder for unknown plugins.
Other vulnerabilities in Electrum
See all- CVE-2026-117603Medium
Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation.
- CVE-2026-117601High
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an attacker address, tricking users into RBF fee-bumping and signing it.
Original NVD description (English source)
Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data directory can place plugin code in the plugins/ folder and mark it enabled, causing arbitrary code execution inside the Electrum process.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS