PT-2026-1563 · WordPress · Moneyspace

Kannika Khongpan · Published 2026-01-07 · Updated 2026-02-02 · CVE-2025-13371

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MoneySpace plugin for WordPress versions prior to 2.13.9

Description The MoneySpace plugin for WordPress exhibits a sensitive information exposure issue. The plugin stores complete payment card details – including Primary Account Number (PAN), cardholder name, expiry date, and Card Verification Value (CVV) – in WordPress post metadata using base64 encoding. These details are then embedded directly into the JavaScript of the publicly accessible mspaylink page without any authentication or authorization. This allows unauthenticated attackers who know or can guess an order ID to access the mspaylink endpoint and retrieve full credit card information directly from the HTML/JS response, resulting in a significant PCI-DSS compliance violation.

Recommendations Update the MoneySpace plugin to a version later than 2.13.9.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-13371

Affected Products

Moneyspace

References · 14

• https://osv.dev/vulnerability/CVE-2025-13371 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13371 · Security Note
• https://github.com/MoneySpace-net/money-space-for-Woocommerce/blob/e79d96cfc1b12cece15c6f0b309045403cc6a9d2/view/mspaylink.php#L164 · Note
• https://github.com/MoneySpace-net/money-space-for-Woocommerce/blob/e79d96cfc1b12cece15c6f0b309045403cc6a9d2/view/mspaylink.php#L232 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3426909%40money-space&new=3426909%40money-space&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/2008795328556781952 · Twitter Post
• https://plugins.trac.wordpress.org/browser/money-space/trunk/view/mspaylink.php#L232 · Note
• https://plugins.trac.wordpress.org/browser/money-space/tags/2.13.9/view/mspaylink.php#L232 · Note
• https://twitter.com/cracbot/status/2010668121125011826 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/77db827d-9afd-4b59-b0ad-1ad562634c52?source=cve · Note
• https://twitter.com/RedPacketSec/status/2008927788582023435 · Twitter Post
• https://twitter.com/DavidMarquet19/status/2018233146538414344 · Twitter Post
• https://twitter.com/CveFindCom/status/2008881505741820196 · Twitter Post
• https://twitter.com/TheHackerWire/status/2008935904455561357 · Twitter Post