CVE-2025-15513: 
WordPress vulnerability analysis and mitigation

CVE-2025-15513 is an Incorrect Authorization vulnerability in the Float Payment Gateway plugin for WordPress, affecting all versions up to and including 1.1.9. The flaw stems from improper error handling in the verifyFloatResponse() function, allowing unauthenticated attackers to mark any WooCommerce order as failed. It was disclosed on January 14, 2026, with Wordfence as the CNA. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-863 (Incorrect Authorization), arising from improper error handling within the verifyFloatResponse() function located at index.php line 477 of the plugin. Because the function does not properly validate or authorize the caller before processing payment response data, an unauthenticated remote attacker can send crafted requests to manipulate WooCommerce order statuses. No authentication or special privileges are required, and no user interaction is needed to trigger the vulnerability (Wordfence, WordPress Trac).

Successful exploitation allows an unauthenticated attacker to arbitrarily mark any WooCommerce order as failed, disrupting e-commerce operations and potentially causing financial harm to merchants and customers. The impact is limited to integrity — there is no confidentiality or availability impact — but repeated abuse could disrupt order fulfillment workflows, trigger fraudulent refund requests, or undermine customer trust in affected online stores (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-15513 as of the available data. The EPSS score is approximately 0.051%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires no authentication, no user interaction, and low complexity, making it technically straightforward to exploit if targeted (Red Hat CVE).

1. Reconnaissance: Identify WordPress sites using the Float Payment Gateway plugin (versions ≤ 1.1.9) via passive scanning, plugin enumeration tools, or by checking publicly accessible readme.txt files in the plugin directory.
2. Identify the vulnerable endpoint: Locate the WordPress REST API or webhook endpoint that invokes the verifyFloatResponse() function, which handles payment gateway callbacks.
3. Craft a malicious request: Send a crafted HTTP request to the payment response endpoint without any authentication credentials, simulating a failed payment response.
4. Trigger order status change: Due to improper error handling in verifyFloatResponse(), the function processes the unauthenticated request and marks the targeted WooCommerce order as failed.
5. Achieve objective: Repeat for multiple order IDs to disrupt store operations, trigger refund workflows, or manipulate specific transactions (Wordfence, WordPress Trac).

• Network: Unusual unauthenticated POST requests to the Float Payment Gateway callback/webhook endpoint from unexpected IP addresses or at abnormal frequencies.
• Logs: WordPress or WooCommerce access logs showing repeated requests to the payment response handler without valid session tokens or authentication headers; multiple orders transitioning to 'failed' status in a short time window.
• Application: Unexpected bulk order status changes to 'failed' in WooCommerce order history, particularly for orders not associated with actual payment failures from the Float gateway.

Users should update the Float Payment Gateway plugin to a version beyond 1.1.9 that includes a fix for the verifyFloatResponse() function. A patch changeset is available in the WordPress plugin repository (WordPress Trac Changeset). As a temporary workaround, site administrators may consider disabling the Float Payment Gateway plugin until a patched version is applied, or restricting access to the payment callback endpoint via web application firewall (WAF) rules (Wordfence).