PT-2026-7486 · WordPress · Pix Para Woocommerce

Published 2026-02-11 · Updated 2026-02-11 · CVE-2025-15400

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Pix para Woocommerce WordPress plugin versions through 2.13.3

Description The plugin allows any authenticated user to trigger AJAX actions that reset payment gateway configuration options without proper capability or nonce checks. This allows authenticated users, including those with subscriber privileges, to clear API credentials and webhook status, leading to persistent disruption of OpenPix payment functionality.

Recommendations Update Pix para Woocommerce to a version later than 2.13.3.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-15400

Affected Products

Pix Para Woocommerce

References · 4

• 🔥 https://wpscan.com/vulnerability/54c1251f-96be-4d70-b773-3db26b599838 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-15400 · Security Note
• https://t.me/CVEtracker/44379 · Telegram Post
• https://t.me/cveNotify/151661 · Telegram Post