Executive brief
The Fortis for WooCommerce plugin for WordPress, which integrates payment processing into online stores, contains a security flaw that exposes sensitive API credentials. An unauthorized person can access these keys without logging in, potentially allowing them to view private customer data, including order history and personally identifiable information (PII). This could lead to significant privacy breaches and reputational damage for affected merchants.
Technical details
The Fortis for WooCommerce plugin (versions prior to 1.3.1) suffers from a sensitive data disclosure vulnerability (CWE-200). The flaw exists in the 'fortis_ajax_request' AJAX action, which can be triggered by unauthenticated users via wp-admin/admin-ajax.php. When invoked, the server returns a JSON object containing production_user_id and production_user_api_key. An attacker can use these leaked credentials to authenticate directly against the Fortis API to retrieve sensitive customer information, including PII and past orders. The issue is resolved in version 1.3.1.
Affected products
- Fortis Fortis for WooCommerce < 1.3.1
Timeline
- 2026-04-28: disclosed: Publicly published by WPScan
- 2026-04-28: patched: Fixed in version 1.3.1
- 2026-05-19: advisory: CVE published to NVD dataset