CVE-2025-15400

OpenPix <= 2.13.3 - Subscriber+ Payment Gateway Settings Reset

Medium · published February 11, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
26.9
In the wild
Unconfirmed
What it is

The OpenPix for WooCommerce WordPress plugin through 2.13.3 allows any authenticated user to trigger AJAX actions that reset payment gateway configuration options without capability or nonce checks. This permits any authenticated users, such as subscribers to clear API credentials and webhook status, causing persistent disruption of OpenPix payment functionality.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00346 · 26.9th percentile
Published
2026-02-11T06:00Z
EPSS history
Timeline
  • 11 FEB 06:00Z
    OpenPix <= 2.13.3 - Subscriber+ Payment Gateway Settings Reset
    cvelistv5