CVE-2025-15609: Fortis for WooCommerce Plugin Leaks API Keys to Unauthenticated Attackers

Executive Summary

A high-severity information disclosure vulnerability (CVE-2025-15609) has been identified in the Fortis for WooCommerce WordPress plugin affecting versions prior to 1.3.1. The flaw allows unauthenticated attackers to retrieve sensitive API keys from vulnerable installations, enabling them to query the Fortis payment API directly and access confidential customer data including personally identifiable information (PII) and past order records.

CVSS Score: 7.5 (High)

The vulnerability was published to the NIST National Vulnerability Database on May 19, 2026. Store owners using the Fortis payment gateway integration should update immediately to version 1.3.1 or later.

Vulnerability Overview

Affected Versions

Technical Details

The vulnerability exists in the Fortis for WooCommerce plugin's handling of API credentials. The plugin improperly exposes API keys in a manner accessible to unauthenticated users. An attacker who retrieves these keys gains the ability to:

1. Make authenticated requests to the Fortis payment API
2. Enumerate historical orders and transaction records
3. Access customer PII associated with processed payments
4. Potentially perform unauthorized payment operations depending on API key permissions

Attack Flow:
1. Attacker discovers WordPress site using Fortis for WooCommerce
2. Sends unauthenticated request to vulnerable endpoint
3. Plugin returns sensitive API credentials
4. Attacker uses credentials to authenticate with Fortis API
5. Customer PII, order history, and payment metadata exposed

Impact Assessment

Remediation

Step 1: Update the Plugin Immediately

# Via WP-CLI
wp plugin update fortis-for-woocommerce
 
# Verify installed version
wp plugin get fortis-for-woocommerce --field=version

Or update through the WordPress admin panel: Plugins > Installed Plugins > Fortis for WooCommerce > Update Now.

Step 2: Rotate API Keys

After updating, immediately rotate the Fortis API keys as a precautionary measure:

1. Log in to your Fortis merchant portal
2. Navigate to API Credentials or Developer Settings
3. Revoke existing API keys and generate new ones
4. Update the new credentials in WooCommerce > Settings > Payments > Fortis

Step 3: Audit for Unauthorized Access

Review Fortis API logs for anomalous access patterns indicating potential exploitation:

# Check for unusual API access patterns in your access logs
grep -i "fortis" /var/log/nginx/access.log | grep -v "your-server-ip" | tail -100
 
# Look for unauthenticated requests to WooCommerce payment endpoints
grep "POST /wp-json/wc/v3/payment_gateways" /var/log/nginx/access.log

Step 4: Notify Affected Customers (If Exploited)

If evidence of exploitation is found, follow your data breach response plan and consider customer notification obligations under applicable regulations (GDPR, PIPEDA, CCPA, etc.).

Detection Indicators

Temporary Mitigation (If Immediate Patching Is Not Possible)

If an immediate update cannot be deployed:

1. Deactivate the Fortis for WooCommerce plugin to remove the attack surface
2. Block external access to the vulnerable plugin file paths at the WAF or web server level
3. Rotate API keys immediately to limit damage if already exploited
4. Enable WAF rules targeting WooCommerce plugin endpoint probing

References

• NIST NVD — CVE-2025-15609
• WordPress Plugin Directory — Fortis for WooCommerce

Related Reading

• Critical RCE in WPvivid Backup Plugin Threatens 900,000+
• WordPress Plugin Vulnerability (CVSS 10.0) Under Active Exploitation