The vulnerability is an authorization bypass in Electrum's external plugin loader. When a plugin is marked enabled in the config file, Electrum executes the plugin's __init__.py module without verifying its cryptographic signature. This flaw allows a local process with write permissions to the Electrum data directory to place arbitrary Python code in the plugins/ subfolder, enabling it via the config, and cause that code to run inside the Electrum process. The result is that a local attacker can achieve full arbitrary code execution with the same privileges as the Electrum process.

Affected systems are the Electrum cryptocurrency wallet, produced by spesmilo, in all releases from 4.6.0 up to and including the 4.7.1 series. The flaw exists before the 4.7.2 release, so any installation on those versions of Electrum is vulnerable.

The CVSS score of 8.6 indicates a high severity vulnerability, with a likelihood of being leveraged when a local user can write to the wallet's data directory. The EPSS score is not available, but the absence of a CISA KEV listing does not diminish the local exploitation risk. The attack surface is local, so the prerequisite is access to the file system where the wallet stores its configuration and plugins. An attacker could simply drop a malicious __init__.py file, enable it, and then have arbitrary code executed in Electrum's hub of processes. Given the high local impact, systems that are exposed to local users or that allow write access to the data folder should treat this vulnerability as high risk.