CVE-2026-49066
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The Conekta Payment Gateway versions up to 6.0.0 have a vulnerability that allows unauthenticated access to sensitive data.
Risk Assessment
Organizations may be exposed to the leakage of personal or financial data, which can lead to serious legal and reputational consequences.
Recommendation
It is recommended to update the Conekta Payment Gateway to the latest version to mitigate this vulnerability.
Other vulnerabilities in Conekta Payment Gateway
See all- CVE-2026-95527Medium
The Conekta Payment Gateway plugin in versions up to and including 6.2.4 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. The flaw involves improper access control on plugin functionality.
- CVE-2026-16738Medium
The Conekta Payment Gateway WordPress plugin before version 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount. This allows unauthenticated attackers to mark arbitrary orders as paid without payment.
Original NVD description (English source)
Unauthenticated Sensitive Data Exposure in Conekta Payment Gateway <= 6.0.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS