What is the CVSS score of CVE-2025-15609?

CVE-2025-15609 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Fortis for WooCommerce are affected by CVE-2025-15609?

The Fortis for WooCommerce plugin (versions before 1.3.1) contains an API credential disclosure flaw that exposes customer payment data and order records to any unauthenticated attacker.. A patch is available.

Is there a public PoC exploit available for CVE-2025-15609?

Yes, a public proof-of-concept exploit is available for CVE-2025-15609. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-15609?

Within 24 hours, inventory all WordPress installations running Fortis for WooCommerce and confirm which are below version 1.3.1; assess whether payment API credentials have been exposed by reviewing server logs for unauthorized Fortis API access patterns. Within 7 days, deploy the vendor-released patch to version 1.3.1 across all affected instances and rotate any potentially compromised API credentials with your Fortis account administrator. Within 30 days, complete a forensic audit of exposed customer data to determine breach notification scope and regulatory filing obligations, implement network-level access controls limiting plugin API calls to legitimate internal sources, and conduct PCI-DSS compliance revalidation.

Fortis for WooCommerce CVE-2025-15609

EUVD-2025-209890 HIGH

2026-05-19 WPScan

GHSA-4vhv-3qc3-cx8p

WordPress Information Disclosure Fortis For Woocommerce Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated remote retrieval of secret keys enabling PII disclosure gives AV:N/AC:L/PR:N/UI:N and C:H, with no integrity or availability impact (I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:56 vuln.today

Patch available

May 19, 2026 - 07:16 EUVD

CVE Published

May 19, 2026 - 06:00 cve.org

HIGH 7.5

CVE Published

May 19, 2026 - 06:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The Fortis for WooCommerce WordPress plugin before 1.3.1 may leak sensitive API keys to unauthenticated attackers, allowing them to query Fortis' API and retrieve sensitive customer information, like past orders, PII, etc.

AnalysisAI

Sensitive API key disclosure in the Fortis for WooCommerce WordPress plugin (versions before 1.3.1) exposes payment-gateway credentials to unauthenticated attackers, who can then query the Fortis payment API directly to harvest customer PII and order history. Rated CVSS 7.5 (confidentiality-only impact), the flaw requires no authentication or user interaction and is remotely reachable; publicly available exploit code exists (WPScan), though EPSS remains very low at 0.01% and it is not listed in CISA KEV.

Technical ContextAI

The affected component is the Fortis payment gateway integration for WooCommerce, a PHP plugin extending the WordPress/WooCommerce e-commerce stack. The root cause is an information-exposure weakness (CWE was not assigned in the source data, but this maps to CWE-200/CWE-312 exposure of sensitive credentials): the plugin renders or otherwise exposes secret Fortis API keys in a location reachable by unauthenticated clients rather than restricting them to server-side use. Because these keys authenticate to the upstream Fortis payment API, their disclosure lets an attacker impersonate the merchant integration and pull data the API is designed to protect. The CPE identifies the affected product as cpe:2.3:a:unknown:fortis_for_woocommerce, with the vendor field unresolved in NVD.

RemediationAI

Upgrade to Fortis for WooCommerce 1.3.1 or later, which is the vendor-released patched version and the primary fix. Because leaked API keys should be treated as compromised, after patching you should rotate the Fortis API keys/credentials in the plugin and Fortis merchant console so any keys already harvested become useless. Review Fortis API access logs for anomalous queries against customer/order data during the exposure window. If immediate upgrade is not possible, restrict or firewall access to the endpoint/asset that exposes the keys and consider temporarily deactivating the Fortis payment integration - with the trade-off that this disables Fortis checkout for customers. Refer to the WPScan advisory (https://wpscan.com/vulnerability/220f72ea-e3b4-44c9-8c9b-15662aebb6cb/) for specifics.