CVE-2025-15400
OpenPix <= 2.13.3 - Subscriber+ Payment Gateway Settings Reset
Vexday Risk Score
13Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 6.5EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
11 feb 2026Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
The OpenPix for WooCommerce WordPress plugin through 2.13.3 allows any authenticated user to trigger AJAX actions that reset payment gateway configuration options without capability or nonce checks. This permits any authenticated users, such as subscribers to clear API credentials and webhook status, causing persistent disruption of OpenPix payment functionality.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Productos afectados
Unknown · OpenPix for WooCommerce¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →