---
id: CVE-2026-117602
title: >-
  Electrum before 4.7.2 External Plugin Authorization Bypass Local Code
  Execution
summary: >-
  Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external
  plugin loader, which executes a plugin's __init__.py module when the plugin is
  marked enabled in the config file, without verifying its plugin-password
  signatur…
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-347
vendor: spesmilo
product: electrum
affected:
  - electrum < 4.7.2
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T13:09:52.040Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-117602'
references:
  - url: >-
      https://github.com/spesmilo/electrum/security/advisories/GHSA-vw94-r84p-66qf
    label: GitHub Security Advisory (GHSA-vw94-r84p-66qf)
  - url: >-
      https://github.com/spesmilo/electrum/commit/032dfcf107da1d31bbee5d64ca978e554fd8e982
    label: Patch Commit
  - url: >-
      https://github.com/spesmilo/electrum/commit/fd7164d6dc1560b6f153c018cabf17e9411c5414
    label: Patch Commit
  - url: >-
      https://www.vulncheck.com/advisories/electrum-before-4.7.2-external-plugin-authorization-bypass-local-code-execution
    label: >-
      VulnCheck Advisory: Electrum before 4.7.2 External Plugin Authorization
      Bypass Local Code Execution
tags:
  - cve.org
ingestedAt: '2026-10-27T16:11:59.341Z'
---

## Overview

Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data directory can place plugin code in the plugins/ folder and mark it enabled, causing arbitrary code execution inside the Electrum process.

## Affected

- `electrum < 4.7.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.