PT-2026-2840 · WordPress · Float Payment Gateway

Published 2026-01-14 · Updated 2026-01-14 · CVE-2025-15513

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Float Payment Gateway plugin for WordPress versions up to and including 1.1.9

Description The Float Payment Gateway plugin for WordPress is susceptible to unauthorized data modification because of inadequate error handling within the verifyFloatResponse() function. This flaw allows unauthenticated attackers to change the status of any WooCommerce order to 'failed'.

Recommendations Update the Float Payment Gateway plugin to a version newer than 1.1.9.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-15513

Affected Products

Float Payment Gateway

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-15513 · Security Note
• https://plugins.trac.wordpress.org/browser/float-gateway/tags/1.1.9/index.php#L477 · Note
• https://twitter.com/CVEnew/status/2011382972495061272 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2011367460893507741 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b2c7fb39-d128-4285-8bc3-1e192e1e1196?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3444078%40float-gateway&new=3444078%40float-gateway&sfp_email=&sfph_mail= · Note