Hard-Coded Credentials vulnerabilities in WordPress plugins and themes
A hard-coded credential is a password or key embedded in the code itself, so it is the same on every installation and cannot be changed by the site owner. Once it is published in an advisory it is public knowledge. Updating is the only remedy; no external control substitutes for it.
What an attacker can do: use a password shipped inside the software, identical on every install CWE-798
- Buy Now Pay Later Addi - Hard-Coded Credentials (CVE-2026-27073) HIGH
- Helpie Faq - Hard-Coded Credentials (CVE-2025-58659) MEDIUM
- Estonian Shipping Methods For Woocommerce - Hard-Coded Credentials (CVE-2025-58656) MEDIUM
- Wedevs Project Manager - Hard-Coded Credentials (CVE-2025-58269) MEDIUM
- CVE-2024-55927 HIGH