CVE-2026-95527
MediumCVSS 6.5Summary
The Conekta Payment Gateway plugin in versions up to and including 6.2.4 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. The flaw involves improper access control on plugin functionality.
Risk Assessment
An unauthenticated attacker may access functionality that should be protected, potentially leading to unauthorized operations in the e-commerce site.
Recommendation
Update the Conekta Payment Gateway plugin to a version newer than 6.2.4 as soon as a fix becomes available.
Other vulnerabilities in Conekta Payment Gateway
See all- CVE-2026-16738Medium
The Conekta Payment Gateway WordPress plugin before version 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount. This allows unauthenticated attackers to mark arbitrary orders as paid without payment.
- CVE-2026-49066High
The Conekta Payment Gateway versions up to 6.0.0 have a vulnerability that allows unauthenticated access to sensitive data.
Original NVD description (English source)
Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions.