CVE-2026-49066: WordPress Conekta Payment Gateway plugin <= 6.0.0 - Sensitive Data Exposure vulnerability

Q: Who can exploit this issue?

The issue is unauthenticated, so an attacker does not need a WordPress account or other prior privileges. It is reachable over the network with low attack complexity and requires no user interaction.

Q: What is the likely impact if exploitation succeeds?

The vulnerability can expose sensitive data. The provided impact metrics indicate high confidentiality impact, with no indicated integrity or availability impact.

Q: Which installations are known to be affected?

Conekta Payment Gateway plugin versions 6.0.0 and earlier are identified as affected. The provided data does not state whether any particular configuration or deployment condition is required.

Published Jun 15, 2026

Updated

Unauthenticated Sensitive Data Exposure in Conekta Payment Gateway <= 6.0.0 versions.

Affected Software

1 affected component

Conekta Conekta Payment Gateway<=6.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Conekta Payment Gateway Plugin to a version that resolves this vulnerability.
Fixed in 6.0.1

Event History

Jun 15, 2026

CVE Published

via MITRE·08:19 PM

Data Sourced

via MITRE·08:19 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The issue is unauthenticated, so an attacker does not need a WordPress account or other prior privileges. It is reachable over the network with low attack complexity and requires no user interaction.

What is the likely impact if exploitation succeeds?

The vulnerability can expose sensitive data. The provided impact metrics indicate high confidentiality impact, with no indicated integrity or availability impact.

Which installations are known to be affected?

Conekta Payment Gateway plugin versions 6.0.0 and earlier are identified as affected. The provided data does not state whether any particular configuration or deployment condition is required.

CVE-2026-49066: WordPress Conekta Payment Gateway plugin <= 6.0.0 - Sensitive Data Exposure vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the likely impact if exploitation succeeds?

Which installations are known to be affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the likely impact if exploitation succeeds?

Which installations are known to be affected?