CVE-2025-15513: Float Payment Gateway Auth Bypass Flaw

CVE-2025-15513 Overview

The Float Payment Gateway plugin for WordPress contains an authorization bypass vulnerability due to improper error handling in the verifyFloatResponse() function. This security flaw affects all versions up to and including 1.1.9, allowing unauthenticated attackers to modify WooCommerce order statuses without proper authorization. The vulnerability stems from inadequate validation of payment verification responses, enabling malicious actors to mark legitimate orders as failed.

Critical Impact

Unauthenticated attackers can manipulate WooCommerce order statuses, potentially disrupting e-commerce operations and causing financial losses through unauthorized order cancellations.

Affected Products

• Float Payment Gateway plugin for WordPress versions up to and including 1.1.9
• WordPress installations running WooCommerce with the vulnerable Float Payment Gateway plugin

Discovery Timeline

• 2026-01-14 - CVE-2025-15513 published to NVD
• 2026-01-14 - Last updated in NVD database

Technical Details for CVE-2025-15513

Vulnerability Analysis

This vulnerability is classified under CWE-863 (Incorrect Authorization), indicating a fundamental flaw in how the plugin verifies and authorizes payment gateway responses. The verifyFloatResponse() function fails to properly validate incoming requests, allowing unauthenticated users to trigger order status changes without proper authorization checks.

The vulnerability is accessible over the network without requiring any user interaction or prior authentication. While the confidentiality impact is none, the integrity impact allows attackers to modify order data, potentially causing significant business disruption for WooCommerce store operators.

Root Cause

The root cause lies in improper error handling within the verifyFloatResponse() function located in the plugin's main index.php file. When the function encounters certain error conditions during payment verification, it fails to properly validate the source and authenticity of the request before processing order status updates. This allows crafted requests to bypass authorization checks and directly manipulate order states.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can send specially crafted HTTP requests to the WordPress site targeting the Float Payment Gateway's verification endpoint. By exploiting the improper error handling in verifyFloatResponse(), the attacker can trigger order status changes to mark any WooCommerce order as failed.

The attack flow involves:

1. Identifying a WordPress site using the Float Payment Gateway plugin
2. Crafting malicious requests that exploit the error handling flaw
3. Submitting requests to trigger unauthorized order status modifications
4. Successfully marking legitimate orders as failed without authentication

For technical implementation details, refer to the WordPress Plugin Code Review showing the vulnerable code at line 477.

Detection Methods for CVE-2025-15513

Indicators of Compromise

• Unexpected WooCommerce order status changes to "failed" without corresponding customer or admin actions
• Suspicious HTTP requests targeting Float Payment Gateway verification endpoints from external IP addresses
• Unusual patterns of order failures that don't correlate with legitimate payment processing issues
• Web server logs showing repeated requests to payment verification endpoints without valid payment sessions

Detection Strategies

• Monitor WooCommerce order status change events for unauthorized modifications, particularly orders changing to "failed" status
• Implement web application firewall (WAF) rules to detect and block suspicious requests to Float Payment Gateway endpoints
• Review WordPress access logs for unusual request patterns targeting /wp-content/plugins/float-gateway/ paths
• Set up alerts for bulk order status changes occurring within short time windows

Monitoring Recommendations

• Enable verbose logging for WooCommerce order status transitions to capture all modification events
• Configure real-time alerting for order status changes that occur without corresponding payment gateway callbacks
• Implement endpoint monitoring for the Float Payment Gateway verification URLs
• Establish baseline metrics for normal order failure rates to detect anomalous spikes

How to Mitigate CVE-2025-15513

Immediate Actions Required

• Update the Float Payment Gateway plugin to a version newer than 1.1.9 that addresses this vulnerability
• If an update is not available, consider temporarily disabling the Float Payment Gateway plugin until a patch is released
• Review recent WooCommerce order history for any suspicious status changes that may indicate exploitation
• Implement additional access controls at the web server or WAF level to restrict access to payment verification endpoints

Patch Information

Organizations using the Float Payment Gateway plugin should check for updates through the WordPress plugin repository. The vulnerability affects all versions up to and including 1.1.9. For detailed vulnerability information and remediation guidance, consult the Wordfence Vulnerability Report.

Workarounds

• Implement web application firewall rules to validate and filter requests to Float Payment Gateway verification endpoints
• Add server-level access controls to restrict which IP addresses can access payment callback URLs
• Consider implementing additional authentication layers for payment verification endpoints at the application or server level
• Monitor and manually verify any order status changes until the plugin is patched or replaced