CVE-2025-15609

Description

The Fortis for WooCommerce WordPress plugin before 1.3.1 may leak sensitive API keys to unauthenticated attackers, allowing them to query Fortis' API and retrieve sensitive customer information, like past orders, PII, etc.

PUBLISHED Reserved 2026-03-12 | Published 2026-05-19 | Updated 2026-05-19 | Assigner WPScan

Problem types

CWE-200 Information Exposure

Product status

Credits

WPScan Team finder

WPScan coordinator

References

wpscan.com/...rability/220f72ea-e3b4-44c9-8c9b-15662aebb6cb/ exploit vdb-entry technical-description

cve.org (CVE-2025-15609)

nvd.nist.gov (CVE-2025-15609)

Download JSON