The Fortis for WooCommerce plugin prior to version 1.3.1 contains an information exposure vulnerability (CWE-200) that leaks sensitive API keys to unauthenticated attackers. These leaked keys enable attackers to query the Fortis API and access sensitive customer information including order history and PII. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. There is no vendor advisory or patch information available at this time.

Exploitation of this vulnerability can lead to unauthorized disclosure of sensitive customer data, including personally identifiable information and order details, potentially resulting in privacy violations and reputational damage. The attacker does not need any privileges or user interaction to exploit this issue, increasing the risk of exposure. There is no indication that integrity or availability are affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the Fortis for WooCommerce plugin or restricting access to the API keys and related endpoints as a temporary measure. Monitor vendor channels for updates and apply patches promptly once available.