CVE-2025-15400

MEDIUM

Pix para Woocommerce <2.13.3 - Privilege Escalation

Title source: llm

Description

The OpenPix for WooCommerce WordPress plugin through 2.13.3 allows any authenticated user to trigger AJAX actions that reset payment gateway configuration options without capability or nonce checks. This permits any authenticated users, such as subscribers to clear API credentials and webhook status, causing persistent disruption of OpenPix payment functionality.

References (1)

Core 1

Core References

Third Party Advisory exploit vdb-entry technical-description

https://wpscan.com/vulnerability/54c1251f-96be-4d70-b773-3db26b599838/

Scores

CVSS v3 6.5

EPSS 0.0031

EPSS Percentile 22.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (2)

None/OpenPix for WooCommerce < 2.13.3

Unknown/Pix para Woocommerce < 2.13.3

Published Feb 11, 2026

Tracked Since Feb 18, 2026