CVE-2024-10938
OVRI Payment 1.7.0 - Malicious .htaccess directive
- State
- Published
- Severity
- 6.5 Medium
- Published
- Feb 27, 2026
- Updated
- Feb 27, 2026
- Reserved
- Nov 6, 2024
Description
The OVRI Payment plugin for WordPress contains malicious .htaccess files in version 1.7.0. The files contain directives to prevent the execution of certain scripts while allowing execution of known malicious PHP files. If moved outside of the plugin's directory, they may interfere with the proper function of a site.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L | Wordfence |
Weaknesses
- CWE-506 Embedded Malicious Code
Affected Products
| Product | Versions |
|---|---|
OVRI Paymentmoneytigo |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.