CVE-2025-15513

Float Payment Gateway <= 1.1.9 - Improper Authorization to Unauthenticated Order Status Manipulation

CVSS 5.3 MEDIUMEPSS 0.2%CWE-863

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.3EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

14 Jan 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The Float Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to improper error handling in the verifyFloatResponse() function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to mark any WooCommerce order as failed.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected products

floattechnologies · Float Payment Gateway

References

https://plugins.trac.wordpress.org/browser/float-gateway/tags/1.1.9/index.php#L477 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3444078%40float-gateway&new=3444078%40float-gateway&sfp_email=&sfph_mail=https://www.wordfence.com/threat-intel/vulnerabilities/id/b2c7fb39-d128-4285-8bc3-1e192e1e1196?source=cve