Electrum before version 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect (NWC) plugin that allows malicious NWC clients to exceed the configured daily_limit_sat. The flaw arises from non‑atomic budget checks and millisatoshi truncation: attackers can send concurrent pay_invoice requests that pass budget_allows_spend() before add_to_budget() updates the ledger, or repeatedly pay amounts that are floored to whole satoshis, draining funds beyond the limit. This can result in an attacker controlling more bitcoin than the wallet owner authorizes, effectively enabling unauthorized fund transfer.

The vulnerability affects all Electrum installations that include the Nostr Wallet Connect plugin prior to version 4.7.2, maintained by spesmilo. Users who have enabled the plugin and set a daily spending cap are vulnerable until the plugin is updated. No other vendors or product families are impacted.

The CVSS score of 9.3 signals critical severity. No EPSS value is reported, and the flaw is not listed in CISA's KEV catalog. Attackers need a malicious NWC client that can communicate with the target Electrum wallet; once the user accepts a connection or a compromised NWC node is used, the attacker can drain the wallet within the same day. The combination of high severity, direct loss of funds, and the potential ease of exploitation warrants immediate attention.