CVE-2026-96255

Summary

The Hubtel WordPress plugin creates a debug log file that contains payment gateway API credentials in plain text, but fails to restrict public access to this file. This allows unauthenticated attackers to download the log and extract sensitive credentials without any authentication or authorization.

Exploitability

Exploitation is straightforward with no prerequisites - attackers simply need to access the publicly available debug log file through a direct HTTP request to obtain the plain-text API credentials.

Blast radius

If exploited, attackers could gain access to multiple payment gateway accounts using the stolen credentials, potentially leading to unauthorized transactions and financial losses across all stores using the compromised plugin version.

Detection

Monitor for HTTP GET requests to /wp-content/plugins/hubtel-payments/debug.log or similar debug log file paths in web server logs, particularly those returning 200 status codes with content-length greater than zero bytes.

Prioritized remediation

Upgrade to version 1.0.2 or later which fixes the public access vulnerability in the debug log file.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.