CVE-2026-7626

The Slek Gateway for WooCommerce plugin for WordPress is vulnerable to Information Exposure in version 1.0. This is due to the wsb_handle_slek_payment_redirect() function placing the merchant's slek_key and slek_secret API credentials directly into a client-side HTML form, and additionally embedding the slek_secret as a plaintext GET parameter in the IPN callback URL. This makes it possible for unauthenticated attackers who can place an order on the affected store to extract the merchant's API credentials by viewing the HTML source or using browser DevTools on the WooCommerce order-pay page before the JavaScript auto-submit fires.

• CWE-200

• https://plugins.trac.wordpress.org/browser/slek-gateway-for-woocommerce/tags/1.0/slek-gateway-for-woocommerce.php#L267
• https://plugins.trac.wordpress.org/browser/slek-gateway-for-woocommerce/tags/1.0/slek-gateway-for-woocommerce.php#L307
• https://plugins.trac.wordpress.org/browser/slek-gateway-for-woocommerce/trunk/slek-gateway-for-woocommerce.php#L267
• https://plugins.trac.wordpress.org/browser/slek-gateway-for-woocommerce/trunk/slek-gateway-for-woocommerce.php#L307
• https://www.wordfence.com/threat-intel/vulnerabilities/id/45ccc116-866e-467f-8ebb-8a3b6589c069?source=cve

Published

May 12, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7618The EnvíaloSimple: Email Marketing y Newsletters plugin for …4.9
• CVE-2026-7619The Charitable – Donation Plugin for WordPress – Fundraising…6.5
• CVE-2026-7620The Notification for Telegram plugin for WordPress is vulner…4.3
• CVE-2026-7621The SMTP2GO for WordPress – Email Made Easy plugin for WordP…4.3
• CVE-2026-7623The SureForms – Contact Form, Payment Form & Other Custom Fo…6.4
• CVE-2026-7624The SEO Plugin by Squirrly SEO plugin for WordPress is vulne…4.3
• CVE-2026-7627A security vulnerability has been detected in 8nite metatrad…6.3
• CVE-2026-7628A vulnerability was detected in crazyrabbitLTC mcp-code-revi…6.3
• CVE-2026-7629A flaw has been found in kleneway awesome-cursor-mpc-server …6.3
• CVE-2026-7630A vulnerability has been found in innocommerce InnoShop up t…7.3
• CVE-2026-7631A vulnerability was found in code-projects Online Hospital M…5.4
• CVE-2026-7632A vulnerability was determined in code-projects Online Hospi…7.3