PT-2026-1563 · WordPress · Moneyspace

Kannika Khongpan · Publicado 2026-01-07 · Atualizado 2026-02-02 · CVE-2025-13371

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MoneySpace plugin for WordPress versions prior to 2.13.9

Description The MoneySpace plugin for WordPress exhibits a sensitive information exposure issue. The plugin stores complete payment card details – including Primary Account Number (PAN), cardholder name, expiry date, and Card Verification Value (CVV) – in WordPress post metadata using base64 encoding. These details are then embedded directly into the JavaScript of the publicly accessible mspaylink page without any authentication or authorization. This allows unauthenticated attackers who know or can guess an order ID to access the mspaylink endpoint and retrieve full credit card information directly from the HTML/JS response, resulting in a significant PCI-DSS compliance violation.

Recommendations Update the MoneySpace plugin to a version later than 2.13.9.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2025-13371

Produtos afetados

Moneyspace

Referências · 14

• https://github.com/MoneySpace-net/money-space-for-Woocommerce/blob/e79d96cfc1b12cece15c6f0b309045403cc6a9d2/view/mspaylink.php#L164 · Nota
• https://github.com/MoneySpace-net/money-space-for-Woocommerce/blob/e79d96cfc1b12cece15c6f0b309045403cc6a9d2/view/mspaylink.php#L232 · Nota
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3426909%40money-space&new=3426909%40money-space&sfp_email=&sfph_mail= · Nota
• https://osv.dev/vulnerability/CVE-2025-13371 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2008795328556781952 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/money-space/trunk/view/mspaylink.php#L232 · Nota
• https://plugins.trac.wordpress.org/browser/money-space/tags/2.13.9/view/mspaylink.php#L232 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-13371 · Nota de Segurança
• https://twitter.com/cracbot/status/2010668121125011826 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/77db827d-9afd-4b59-b0ad-1ad562634c52?source=cve · Nota
• https://twitter.com/RedPacketSec/status/2008927788582023435 · Publicação no Twitter
• https://twitter.com/DavidMarquet19/status/2018233146538414344 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2008881505741820196 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2008935904455561357 · Publicação no Twitter