CVE-2026-27073: Addi Plugin Auth Bypass Vulnerability

CVE-2026-27073 Overview

CVE-2026-27073 is a Use of Hard-coded Credentials vulnerability (CWE-798) affecting the WordPress plugin "Addi – Cuotas que se adaptan a ti" (buy-now-pay-later-addi). This plugin provides buy-now-pay-later payment functionality for WordPress e-commerce sites. The vulnerability enables Password Recovery Exploitation through hard-coded credentials embedded within the plugin, allowing unauthenticated attackers to exploit the password recovery mechanism and potentially gain unauthorized access to user accounts.

Critical Impact
Unauthenticated attackers can exploit hard-coded credentials in the Addi WordPress plugin to manipulate the password recovery process, potentially gaining unauthorized access to user accounts and compromising payment-related functionality.

Affected Products

Addi – Cuotas que se adaptan a ti (buy-now-pay-later-addi) plugin versions through <= 2.0.4
WordPress installations utilizing the affected plugin versions

Discovery Timeline

2026-03-25 - CVE-2026-27073 published to NVD
2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-27073

Vulnerability Analysis

This vulnerability stems from the inclusion of hard-coded credentials within the Addi WordPress plugin's codebase. Hard-coded credentials represent a fundamental security flaw where authentication secrets are embedded directly in source code rather than being configured externally or managed through secure credential storage mechanisms.

The vulnerability allows for Password Recovery Exploitation, meaning attackers can leverage the hard-coded credentials to bypass normal authentication controls during the password recovery process. This attack can be executed remotely over the network without requiring any prior authentication or user interaction, making it particularly dangerous for e-commerce sites processing financial transactions.

The impact primarily affects the integrity of the application, as attackers could modify account credentials or gain unauthorized access to accounts. WordPress sites using this plugin for buy-now-pay-later payment processing are at particular risk due to the sensitive nature of payment information handled by such plugins.

Root Cause

The root cause of this vulnerability is the use of hard-coded credentials within the plugin source code (CWE-798). This security anti-pattern occurs when developers embed authentication credentials, API keys, or secret tokens directly into application code. In this case, the hard-coded credentials can be discovered by anyone with access to the plugin files and exploited to manipulate the password recovery functionality.

This type of vulnerability is particularly problematic because:

The credentials cannot be easily changed without modifying the source code
All installations of the vulnerable plugin versions share the same credentials
Attackers can extract credentials through source code review or reverse engineering

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

Identifying WordPress sites running the vulnerable Addi plugin version <= 2.0.4
Extracting or leveraging the hard-coded credentials from the plugin
Utilizing these credentials to manipulate the password recovery mechanism
Gaining unauthorized access to user accounts or administrative functions

The vulnerability enables exploitation of the password recovery process, which could allow attackers to reset passwords for arbitrary users and take over their accounts. For a buy-now-pay-later payment plugin, this poses significant risks to customer financial data and transaction integrity.

For detailed technical information about this vulnerability, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-27073

Indicators of Compromise

Unusual password reset requests or successful password changes for multiple accounts
Authentication logs showing access using the compromised credential mechanism
Unexpected changes to user account settings or payment configurations
Failed or anomalous login attempts targeting the password recovery endpoint

Detection Strategies

Review WordPress access logs for suspicious activity targeting the Addi plugin endpoints
Monitor for unusual patterns in password reset requests or account modifications
Implement file integrity monitoring to detect unauthorized changes to plugin files
Deploy web application firewall (WAF) rules to detect exploitation attempts
Audit installed plugins and verify versions against known vulnerable releases

Monitoring Recommendations

Enable comprehensive logging for authentication events and password recovery activities
Configure alerts for multiple password reset requests from single IP addresses
Monitor for access to sensitive plugin files or configuration endpoints
Implement anomaly detection for user account behavior changes
Review payment transaction logs for unauthorized or suspicious activities

How to Mitigate CVE-2026-27073

Immediate Actions Required

Identify all WordPress installations running the Addi – Cuotas que se adaptan a ti plugin
Check the currently installed version and determine if it is version 2.0.4 or earlier
Disable the vulnerable plugin until a patched version is available if no workaround exists
Audit user accounts for any unauthorized password changes or suspicious activity
Review and strengthen access controls for all user accounts, particularly administrative accounts

Patch Information

At the time of publication, organizations should check the Patchstack Vulnerability Report for the latest patch information and remediation guidance. Update to a patched version of the plugin as soon as one becomes available from the vendor.

Workarounds

Disable the Addi plugin temporarily until a security patch is released
Implement additional authentication controls such as two-factor authentication for all user accounts
Configure web application firewall rules to restrict access to password recovery endpoints
Apply IP-based access restrictions to administrative functions
Consider using an alternative buy-now-pay-later plugin until this vulnerability is addressed

bash

# WordPress CLI commands to check and manage the vulnerable plugin
# Check installed plugin version
wp plugin list --name=buy-now-pay-later-addi --fields=name,status,version

# Deactivate the vulnerable plugin if necessary
wp plugin deactivate buy-now-pay-later-addi

# Check for available plugin updates
wp plugin update --all --dry-run