CVE-2025-15609

High · 7.5

CVSS

7.5

EPSS

0.4%

Published

May 19, 2026

CISA due date

—

The record

The Fortis for WooCommerce WordPress plugin before 1.3.1 may leak sensitive API keys to unauthenticated attackers, allowing them to query Fortis' API and retrieve sensitive customer information, like past orders, PII, etc.

Affected packages

Ecosystem	Package	Introduced	Fixed