Vulnerability · Published Oct 27, 2026 · Assigned by VulnCheck

CVE-2026-117602Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution

High 8.4

In plain English

A high-severity security flaw in electrum from spesmilo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.4High

Exploit odds (30 days)0.1%top 98.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data directory can place plugin code in the plugins/ folder and mark it enabled, causing arbitrary code execution inside the Electrum process.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:14	electrum	4.7.2+dfsg-1	DEBIAN-CVE-2026-117602

Affected products (as reported)

Vendor	Product	Versions
spesmilo	electrum	0 – before 4.7.2

Weakness: CWE-347 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-vw94-r84p-66qf) vendor-advisory
Patch Commit patch
Patch Commit patch
VulnCheck Advisory: Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution third-party-advisory