Hard-coded Credential Vulnerability in PipraPay by QubePlug
CVE-2026-124624

6.9MEDIUM

Key Information:

Vendor: QubePlug
Status: Piprapay
Vendor: CVE Published:; 9 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-124624?

A vulnerability has been discovered in PipraPay version 3.0.0, specifically within the hash_hmac function found in pp-content/pp-include/pp-adapter.php. This flaw in the pp-token anti-CSRF Handler could allow attackers to manipulate system functions, resulting in hard-coded credentials being exposed. Exploitation can be performed remotely, and the method to execute such attacks has been publicly disclosed. Although the issue was reported to the development team, a response has not yet been issued, indicating a lack of immediate remediation.

Affected Version(s)

PipraPay 3.0.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-124624 - Proof of Concept