CVE-2025-15400
OpenPix <= 2.13.3 - Subscriber+ Payment Gateway Settings Reset
- State
- Published
- Severity
- 6.5 Medium
- Published
- Feb 11, 2026
- Updated
- Apr 2, 2026
- Reserved
- Dec 31, 2025
Description
The OpenPix for WooCommerce WordPress plugin through 2.13.3 allows any authenticated user to trigger AJAX actions that reset payment gateway configuration options without capability or nonce checks. This permits any authenticated users, such as subscribers to clear API credentials and webhook status, causing persistent disruption of OpenPix payment functionality.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N | CISA-ADP |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
OpenPix for WooCommerceUnknown |
|
References
- https://wpscan.com/vulnerability/54c1251f-96be-4d70-b773-3db26b599838/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.