Vulnerability · Published Feb 11, 2026 · Assigned by WPScan

CVE-2025-15400OpenPix <= 2.13.3 - Subscriber+ Payment Gateway Settings Reset

Medium 6.5

In plain English

A medium-severity missing authorization in OpenPix for WooCommerce from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 71.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The OpenPix for WooCommerce WordPress plugin through 2.13.3 allows any authenticated user to trigger AJAX actions that reset payment gateway configuration options without capability or nonce checks. This permits any authenticated users, such as subscribers to clear API credentials and webhook status, causing persistent disruption of OpenPix payment functionality.

Affected products (as reported)

Vendor	Product	Versions
Unknown	OpenPix for WooCommerce	0 – through 2.13.3

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

https://wpscan.com/vulnerability/54c1251f-96be-4d70-b773-3db26b599838/ exploit, vdb-entry, technical-description