CVE-2026-117602: Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution
Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's init.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data directory can place plugin code in the plugins/ folder and mark it enabled, causing arbitrary code execution inside the Electrum process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Electrumto a version that resolves this vulnerability.Fixed in 4.7.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Electrum installations from 4.6.0 before 4.7.2 are exposed if a rogue local process can write to the Electrum data directory. The attacker must be able to place files in the plugins/ folder and modify the configuration to mark the plugin enabled.
Does an attacker need to interact with the Electrum user?
No. The described attack requires local write access to Electrum's data directory, but no user interaction or authentication is required once the attacker can alter the plugin files and enabled-plugin configuration.
What execution context does the malicious code receive?
The rogue plugin's __init__.py is executed inside the Electrum process. This allows arbitrary code execution with the privileges of the Electrum process.
How can I determine whether an installation may be affected?
Check whether the Electrum version is 4.6.0 through any version before 4.7.2, and inspect the Electrum data directory for unexpected content in plugins/ or unexpected enabled-plugin configuration entries.