Electrum: Authorization bypass in external plugin loader allows code execution
Summary
Electrum 4.6.0 before 4.7.2 contains an authorization bypass in its external plugin loader. The loader executes a plugin's __init__.py module when the plugin is marked as enabled in the config file, without verifying the plugin-password signature. A local process with write access to the Electrum data directory can place plugin code in the plugins folder, enable it, and run arbitrary code inside the Electrum process. The attack requires local access to the user's account.
Affected
- Electrum 4.6.0 up to and including 4.7.1 (CNA range: 0 to before 4.7.2)
Fixed in
- Electrum 4.7.2 or later (fix in commits 032dfcf and fd7164d)
Workaround
- Unknown. No vendor workaround was found. Upgrading is the fix.
- Restrict write access to the Electrum data directory.
- Disable external plugins that are not needed.
Exploitation
- Exploited in the wild: Unknown. A third-party tracker reports no known exploitation.
- Public proof of concept: none found in our research.
- EPSS: 0.11 %.
Our recommendation
- Upgrade Electrum to 4.7.2 or later. Upstream has released newer versions since, so install the current release.
- Check the Electrum data directory and its plugins folder for unknown files or enabled plugins you did not install.
- Remove external plugins that are not required.
- Run Electrum wallets on dedicated, hardened workstations with restricted local access.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Commit 032dfcf: plugins authorization decorator github.com
- Commit fd7164d: Merge pull request #10552 github.com
- GitHub Security Advisory GHSA-vw94-r84p-66qf github.com
- VulnCheck advisory: Electrum external plugin authorization bypass www.vulncheck.com
- Vulners NVD mirror: CVE-2026-117602 vulners.com
- Ubuntu security: CVE-2026-117602 ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:01.
Original description (NVD)
Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data directory can place plugin code in the plugins/ folder and mark it enabled, causing arbitrary code execution inside the Electrum process.
NVD references (4)
- https://github.com/spesmilo/electrum/commit/032dfcf107da1d31bbee5d64ca978e554fd8e982
- https://github.com/spesmilo/electrum/commit/fd7164d6dc1560b6f153c018cabf17e9411c5414
- https://github.com/spesmilo/electrum/security/advisories/GHSA-vw94-r84p-66qf
- https://www.vulncheck.com/advisories/electrum-before-4.7.2-external-plugin-authorization-bypass-local-code-ex…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.