CVE-2026-96255: Unknown Payments For Hubtel

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway API credentials in plain text, allowing unauthenticated attackers to obtain those credentials.

Affected products

• Unknown Payments For Hubtel: before 1.0.2 (fixed in 1.0.2)

Published 2026-10-01. Last modified 2026-10-01.