CVE-2026-7626

The Slek Gateway for WooCommerce plugin for WordPress is vulnerable to Information Exposure in version 1.0. This is due to the wsb_handle_slek_payment_redirect() function placing the merchant's slek_key and slek_secret API credentials directly into a client-side HTML form, and additionally embedding the slek_secret as a plaintext GET parameter in the IPN callback URL. This makes it possible for unauthenticated attackers who can place an order on the affected store to extract the merchant's API credentials by viewing the HTML source or using browser DevTools on the WooCommerce order-pay page before the JavaScript auto-submit fires.

• CWE-200

• https://plugins.trac.wordpress.org/browser/slek-gateway-for-woocommerce/tags/1.0/slek-gateway-for-woocommerce.php#L267
• https://plugins.trac.wordpress.org/browser/slek-gateway-for-woocommerce/tags/1.0/slek-gateway-for-woocommerce.php#L307
• https://plugins.trac.wordpress.org/browser/slek-gateway-for-woocommerce/trunk/slek-gateway-for-woocommerce.php#L267
• https://plugins.trac.wordpress.org/browser/slek-gateway-for-woocommerce/trunk/slek-gateway-for-woocommerce.php#L307
• https://www.wordfence.com/threat-intel/vulnerabilities/id/45ccc116-866e-467f-8ebb-8a3b6589c069?source=cve

Published

May 12, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-76254In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, …8.8
• CVE-2026-76255In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.8, …7.3
• CVE-2026-76256In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, …4.3
• CVE-2026-76257In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, …6.5
• CVE-2026-76258In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, …6.5
• CVE-2026-76259In Splunk Enterprise for Windows versions below 10.4.2, 10.2…7.8
• CVE-2026-76260In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, …6.5
• CVE-2026-76261In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, …6.5
• CVE-2026-76262In Splunk Enterprise 10.4 versions below 10.4.2, an unauthen…7.5
• CVE-2026-76263In Splunk Enterprise versions below 10.4.2 and 10.2.6, a use…5.4
• CVE-2026-7627A security vulnerability has been detected in 8nite metatrad…6.3
• CVE-2026-7628A vulnerability was detected in crazyrabbitLTC mcp-code-revi…6.3