The Fortis for WooCommerce WordPress plugin versions prior to 1.3.1 may reveal sensitive API keys to unauthenticated attackers. These keys allow the attacker to query Fortis' API and obtain confidential customer information, including past orders and personally identifiable information. The vulnerability is an example of information exposure, permitting an attacker to gain unauthorized access to protected data.

The vulnerability affects the Fortis for WooCommerce plugin, a WordPress extension used for payment processing, in all releases before version 1.3.1. Any WordPress site deploying these affected versions is susceptible, regardless of other configuration settings. No additional third‑party software is impacted.

The attack vector is likely via unauthenticated HTTP requests to the plugin’s API endpoints, which are publicly reachable on the site. The EPSS score of <1% indicates a low likelihood of exploitation; however, the vulnerability remains a concern because any exposure of API keys allows an attacker to query Fortis' API and retrieve customer data. The CVSS score is 7.5, and the vulnerability is not listed in the CISA KEV catalog. Immediate remediation is recommended due to the sensitivity of the information exposed.