CVE-2025-15513
Float Payment Gateway <= 1.1.9 - Improper Authorization to Unauthenticated Order Status Manipulation
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The Float Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to improper error handling in the verifyFloatResponse() function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to mark any WooCommerce order as failed.
| CWE | CWE-863 |
| Vendor | floattechnologies |
| Product | float payment gateway |
| Published | Jan 14, 2026 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for floattechnologies float payment gateway
Be the first to know when new medium vulnerabilities affecting floattechnologies float payment gateway are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
floattechnologies / Float Payment Gateway
0 ≤ 1.1.9
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/b2c7fb39-d128-4285-8bc3-1e192e1e1196?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/float-gateway/tags/1.1.9/index.php#L477 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3444078%40float-gateway&new=3444078%40float-gateway&sfp_email=&sfph_mail=
Credits
Md. Moniruzzaman Prodhan