CVE-2024-10938
OVRI Payment 1.7.0 - Malicious .htaccess directive
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
The OVRI Payment plugin for WordPress contains malicious .htaccess files in version 1.7.0. The files contain directives to prevent the execution of certain scripts while allowing execution of known malicious PHP files. If moved outside of the plugin's directory, they may interfere with the proper function of a site.
| CWE | CWE-506 |
| Vendor | moneytigo |
| Product | ovri payment |
| Published | Feb 27, 2026 |
| Last Updated | Feb 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for moneytigo ovri payment
Be the first to know when new medium vulnerabilities affecting moneytigo ovri payment are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
moneytigo / OVRI Payment
1.7.0
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/2b45674c-8446-44eb-a45a-15dab02c89cf?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/moneytigo/tags/1.7.0/.htaccess plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/moneytigo/tags/1.7.0/assets/.htaccess
Credits
Marco Wotschka