Vulnerability · Published May 19, 2026 · Assigned by WPScan
CVE-2025-15609Fortis For WooCommerce < 1.3.1 - Sensitive API Key Disclosure
High 7.5
In plain English
A high-severity security flaw in Fortis for WooCommerce from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 65.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Fortis for WooCommerce WordPress plugin before 1.3.1 may leak sensitive API keys to unauthenticated attackers, allowing them to query Fortis' API and retrieve sensitive customer information, like past orders, PII, etc.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Fortis for WooCommerce | 0 – before 1.3.1 |
References
- https://wpscan.com/vulnerability/220f72ea-e3b4-44c9-8c9b-15662aebb6cb/ exploit, vdb-entry, technical-description