CVE-2026-117602GHSA-vw94-r84p-66qf
Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution
spesmilo electrum
CVSS
8.6HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 4.7.2electrumCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Reports 2
1 outlet mention it. Reports are not confirmation; each links to its source.
- @thehackerwire.bsky.social: 🟠 CVE-2026-117602 - High (8.4) Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which... https://www.thehackerwire.com/vulnerability/CVE-Bluesky: CVE posts, 27 Oct 2026
- @cve.skyfleet.blue: CVE-2026-117602 - Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution CVE ID : CVE-2026-117602 Published : Oct. 27, 2026, 2:16 p.m. | 7 minutes ago DescBluesky: CVE posts, 27 Oct 2026
Description
Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data directory can place plugin code in the plugins/ folder and mark it enabled, causing arbitrary code execution inside the Electrum process.
Text from CVE List
Affected versions 2
- electrumaffected: all versions before 4.7.2CVE List
- electrumunaffected: 4.7.2CVE List
References 4
- github.com/spesmilo/electrum/commit/032dfcf107da1d31bbee5d64ca978e554fd8e982Fixvia CVE List
- github.com/spesmilo/electrum/commit/fd7164d6dc1560b6f153c018cabf17e9411c5414Fixvia CVE List
- github.com/spesmilo/electrum/security/advisories/GHSA-vw94-r84p-66qfAdvisoryvia CVE List
- vulncheck.com/advisories/electrum-before-4.7.2-external-plugin-authorization-bypass-local-code-executionAdvisoryvia CVE List