CVE-2025-15400

OpenPix <= 2.13.3 - Subscriber+ Payment Gateway Settings Reset

CVSS 6.5 MEDIUMEPSS 0.3%CWE-862

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 6.5EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

11 Feb 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The OpenPix for WooCommerce WordPress plugin through 2.13.3 allows any authenticated user to trigger AJAX actions that reset payment gateway configuration options without capability or nonce checks. This permits any authenticated users, such as subscribers to clear API credentials and webhook status, causing persistent disruption of OpenPix payment functionality.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected products

Unknown · OpenPix for WooCommerce

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://wpscan.com/vulnerability/54c1251f-96be-4d70-b773-3db26b599838/