CVE-2025-15609

Fortis For WooCommerce < 1.3.1 - Sensitive API Key Disclosure

High · published May 19, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
33.5
In the wild
Unconfirmed
What it is

The Fortis for WooCommerce WordPress plugin before 1.3.1 may leak sensitive API keys to unauthenticated attackers, allowing them to query Fortis' API and retrieve sensitive customer information, like past orders, PII, etc.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00404 · 33.5th percentile
Published
2026-05-19T06:00Z
EPSS history
Timeline
  • 19 MAY 06:00Z
    Fortis For WooCommerce < 1.3.1 - Sensitive API Key Disclosure
    cvelistv5