The OpenPix for WooCommerce plugin through version 2.13.3 fails to validate the user's capabilities or present nonce checks when processing AJAX requests that reset payment‑gateway settings. An attacker who is any authenticated user, such as a subscriber, can therefore execute those actions and clear API credentials and webhook status. The result is a persistent loss of payment functionality rather than code execution or direct data theft. This vulnerability is an example of the missing authorization flaw described by CWE‑862.

WordPress sites running the OpenPix for WooCommerce plugin of version 2.13.3 or earlier are affected. The plugin is distributed for WordPress and is referenced as Unknown:OpenPix for WooCommerce in vendor records. No other products or versions are specified.

With a CVSS score of 6.5 the vulnerability is classified as moderate severity. The EPSS score of less than 1% indicates a low likelihood of exploitation at this time, and it is not listed in the CISA KEV catalog. The lack of capability or nonce verification means any authenticated user can trigger the reset, so the attack vector is an authenticated, non‑privileged user role. Because the impact is limited to the configuration of the payment system and does not allow arbitrary code execution, the overall risk is moderate but can cause significant service disruption for merchants relying on OpenPix.