Knight Squad Academy
Vulnerability advisory

CVE-2025-15513

Research by Md. Moniruzzaman Prodhan January 14, 2026
Overview

Summary

The Float Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to improper error handling in the verifyFloatResponse() function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to mark any WooCommerce order as failed.

Risk profile

CVSS assessment

5.3 · M E D I U M
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
N E T W O R K
Complexity
L O W
Privileges
N O N E
User interaction
N O N E
Scope
U N C H A N G E D
Confidentiality
N O N E
Integrity
L O W
Availability
N O N E
Classification

Weaknesses

  • Incorrect Authorization CWE-863
Further reading

References

3 sources
  1. plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/float-gateway/tags/1.1.9/index.php#L477
  2. plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3444078%40float-gateway&new=3444078%40float-gateway&sfp_email=&sfph_mail=
  3. www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/b2c7fb39-d128-4285-8bc3-1e192e1e1196?source=cve