PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-49066 Conekta Group CVE debrief

CVE-2026-49066 is a high-severity vulnerability (CVSS Score: 7.5) affecting Conekta Payment Gateway plugin versions <= 6.0.0. This vulnerability allows unauthenticated sensitive data exposure. The CVE was published on 2026-06-15T21:17:19.417Z and last modified on 2026-06-15T21:24:32.790Z.

Vendor
Conekta Group
Product
Conekta Payment Gateway
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-15
Original CVE updated
2026-06-15
Advisory published
2026-06-15
Advisory updated
2026-06-15

Who should care

Users of Conekta Payment Gateway plugin versions <= 6.0.0 should be aware of this vulnerability and take necessary actions to mitigate the risk.

Technical summary

The vulnerability has a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N and is classified under CWE-497. It was reported by [email protected] and listed in the NVD database.

Defensive priority

HIGH

Recommended defensive actions

  • Update Conekta Payment Gateway plugin to a version greater than 6.0.0.
  • Review and restrict access to sensitive data.
  • Monitor for suspicious activity.

Evidence notes

Evidence suggests that this vulnerability was reported by Patchstack (reference_domain_candidate).

Official resources

CVE-2026-49066 was published on 2026-06-15T21:17:19.417Z and last modified on 2026-06-15T21:24:32.790Z.