CVE-2025-15513 is an authorization vulnerability (CWE-863) in the Float Payment Gateway WordPress plugin affecting all versions up to 1.1.9. The issue arises from improper error handling in the verifyFloatResponse() function, which can be abused by unauthenticated attackers to modify order status by marking WooCommerce orders as failed. The vulnerability does not impact confidentiality or availability, but it affects the integrity of order data. The CVSS 3.1 base score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

An attacker can cause unauthorized modification of WooCommerce order status by marking orders as failed without authentication. This impacts the integrity of order data but does not affect confidentiality or availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor for updates from floattechnologies and consider restricting access or implementing compensating controls to detect unauthorized order status changes. No vendor advisory or patch links are currently provided.