CVE-2026-27073: Addi Plugin Auth Bypass Vulnerability

CVE-2026-27073 Overview

CVE-2026-27073 is a Use of Hard-coded Credentials vulnerability (CWE-798) affecting the WordPress plugin "Addi – Cuotas que se adaptan a ti" (buy-now-pay-later-addi). This plugin provides buy-now-pay-later payment functionality for WordPress e-commerce sites. The vulnerability enables Password Recovery Exploitation through hard-coded credentials embedded within the plugin, allowing unauthenticated attackers to exploit the password recovery mechanism and potentially gain unauthorized access to user accounts.

Critical Impact

Unauthenticated attackers can exploit hard-coded credentials in the Addi WordPress plugin to manipulate the password recovery process, potentially gaining unauthorized access to user accounts and compromising payment-related functionality.

Affected Products

• Addi – Cuotas que se adaptan a ti (buy-now-pay-later-addi) plugin versions through <= 2.0.4
• WordPress installations utilizing the affected plugin versions

Discovery Timeline

• 2026-03-25 - CVE-2026-27073 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-27073

Vulnerability Analysis

This vulnerability stems from the inclusion of hard-coded credentials within the Addi WordPress plugin's codebase. Hard-coded credentials represent a fundamental security flaw where authentication secrets are embedded directly in source code rather than being configured externally or managed through secure credential storage mechanisms.

The vulnerability allows for Password Recovery Exploitation, meaning attackers can leverage the hard-coded credentials to bypass normal authentication controls during the password recovery process. This attack can be executed remotely over the network without requiring any prior authentication or user interaction, making it particularly dangerous for e-commerce sites processing financial transactions.

The impact primarily affects the integrity of the application, as attackers could modify account credentials or gain unauthorized access to accounts. WordPress sites using this plugin for buy-now-pay-later payment processing are at particular risk due to the sensitive nature of payment information handled by such plugins.

Root Cause

The root cause of this vulnerability is the use of hard-coded credentials within the plugin source code (CWE-798). This security anti-pattern occurs when developers embed authentication credentials, API keys, or secret tokens directly into application code. In this case, the hard-coded credentials can be discovered by anyone with access to the plugin files and exploited to manipulate the password recovery functionality.

This type of vulnerability is particularly problematic because:

• The credentials cannot be easily changed without modifying the source code
• All installations of the vulnerable plugin versions share the same credentials
• Attackers can extract credentials through source code review or reverse engineering

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying WordPress sites running the vulnerable Addi plugin version <= 2.0.4
2. Extracting or leveraging the hard-coded credentials from the plugin
3. Utilizing these credentials to manipulate the password recovery mechanism
4. Gaining unauthorized access to user accounts or administrative functions

The vulnerability enables exploitation of the password recovery process, which could allow attackers to reset passwords for arbitrary users and take over their accounts. For a buy-now-pay-later payment plugin, this poses significant risks to customer financial data and transaction integrity.

For detailed technical information about this vulnerability, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-27073

Indicators of Compromise

• Unusual password reset requests or successful password changes for multiple accounts
• Authentication logs showing access using the compromised credential mechanism
• Unexpected changes to user account settings or payment configurations
• Failed or anomalous login attempts targeting the password recovery endpoint

Detection Strategies

• Review WordPress access logs for suspicious activity targeting the Addi plugin endpoints
• Monitor for unusual patterns in password reset requests or account modifications
• Implement file integrity monitoring to detect unauthorized changes to plugin files
• Deploy web application firewall (WAF) rules to detect exploitation attempts
• Audit installed plugins and verify versions against known vulnerable releases

Monitoring Recommendations

• Enable comprehensive logging for authentication events and password recovery activities
• Configure alerts for multiple password reset requests from single IP addresses
• Monitor for access to sensitive plugin files or configuration endpoints
• Implement anomaly detection for user account behavior changes
• Review payment transaction logs for unauthorized or suspicious activities

How to Mitigate CVE-2026-27073

Immediate Actions Required

• Identify all WordPress installations running the Addi – Cuotas que se adaptan a ti plugin
• Check the currently installed version and determine if it is version 2.0.4 or earlier
• Disable the vulnerable plugin until a patched version is available if no workaround exists
• Audit user accounts for any unauthorized password changes or suspicious activity
• Review and strengthen access controls for all user accounts, particularly administrative accounts

Patch Information

At the time of publication, organizations should check the Patchstack Vulnerability Report for the latest patch information and remediation guidance. Update to a patched version of the plugin as soon as one becomes available from the vendor.

Workarounds

• Disable the Addi plugin temporarily until a security patch is released
• Implement additional authentication controls such as two-factor authentication for all user accounts
• Configure web application firewall rules to restrict access to password recovery endpoints
• Apply IP-based access restrictions to administrative functions
• Consider using an alternative buy-now-pay-later plugin until this vulnerability is addressed

# WordPress CLI commands to check and manage the vulnerable plugin
# Check installed plugin version
wp plugin list --name=buy-now-pay-later-addi --fields=name,status,version

# Deactivate the vulnerable plugin if necessary
wp plugin deactivate buy-now-pay-later-addi

# Check for available plugin updates
wp plugin update --all --dry-run