Junglewise Threat Intelligence

CVE-2026-7626: Slek Gateway for WooCommerce information exposure in wsb_handle_slek_payment_redirect

CVE-2026-7626 · Severity: medium · CVSS 5.3 · Published 2026-05-12

Executive brief

The Slek Gateway for WooCommerce plugin, which enables payment processing for WordPress online stores, contains a security flaw that exposes sensitive merchant credentials. An attacker can capture the store owner's private API keys by simply placing an order and inspecting the web page's source code. If these keys are stolen, unauthorized parties could potentially interfere with payment processing or access the merchant's payment account.

Technical details

The Slek Gateway for WooCommerce plugin (v1.0) is vulnerable to sensitive information exposure due to the wsb_handle_slek_payment_redirect() function. The plugin incorrectly embeds the merchant's 'slek_key' and 'slek_secret' API credentials directly into a client-side HTML form and includes the secret as a plaintext GET parameter in the IPN callback URL. An unauthenticated attacker can exploit this by initiating an order and viewing the HTML source or using browser developer tools on the order-pay page before the JavaScript auto-submit occurs. This allows for the extraction of merchant API credentials, which could lead to unauthorized access to the merchant's payment gateway account.

Affected products

  • Slek Slek Gateway for WooCommerce 1.0

Timeline

  • 2026-05-12: disclosed: Initial disclosure by Wordfence
  • 2026-05-12: advisory: NVD publication date

References