CVE-2025-15609
Fortis For WooCommerce < 1.3.1 - Sensitive API Key Disclosure
- State
- Published
- Severity
- 7.5 High
- Published
- May 19, 2026
- Updated
- May 19, 2026
- Reserved
- Mar 12, 2026
Description
The Fortis for WooCommerce WordPress plugin before 1.3.1 may leak sensitive API keys to unauthenticated attackers, allowing them to query Fortis' API and retrieve sensitive customer information, like past orders, PII, etc.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | CISA-ADP |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Fortis for WooCommerceUnknown |
|
References
- https://wpscan.com/vulnerability/220f72ea-e3b4-44c9-8c9b-15662aebb6cb/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.