The Fortis for WooCommerce WordPress plugin versions prior to 1.3.1 may reveal sensitive API keys to unauthenticated attackers. These keys allow the attacker to query Fortis' API and obtain confidential customer information, including past orders and personally identifiable information. The vulnerability is an example of information exposure, permitting an attacker to gain unauthorized access to protected data. The affected weakness aligns with CWE-200.

The vulnerability affects the Fortis for WooCommerce plugin, a WordPress extension used for payment processing, in all releases before version 1.3.1. Any WordPress site deploying these affected versions is susceptible, regardless of other configuration settings. No additional third‑party software is impacted.

The attack vector is likely via unauthenticated HTTP requests to the plugin’s API endpoints, which are publicly reachable on the site. Because the plugin does not require authentication to expose the key, the exploitation probability is high for sites that expose the endpoint. The CVSS score is not provided in the public data, and no EPSS value is available. The vulnerability is not listed in the CISA KEV catalog. However, the direct exposure of API keys for sensitive customer data warrants immediate remediation.