CVE-2025-15400

OpenPix <= 2.13.3 - Subscriber+ Payment Gateway Settings Reset

CVSS 6.5 MEDIUMEPSS 0.3%CWE-862

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 6.5EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

11 fev 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The OpenPix for WooCommerce WordPress plugin through 2.13.3 allows any authenticated user to trigger AJAX actions that reset payment gateway configuration options without capability or nonce checks. This permits any authenticated users, such as subscribers to clear API credentials and webhook status, causing persistent disruption of OpenPix payment functionality.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Produtos afetados

Unknown · OpenPix for WooCommerce

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://wpscan.com/vulnerability/54c1251f-96be-4d70-b773-3db26b599838/