CVE-2025-13371

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-13371
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-13371.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-13371
Published
2026-01-07T06:36:02.802Z
Modified
2026-07-15T01:48:54.096422917Z
Severity
  • 8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
Money Space <= 2.13.9 - Unauthenticated Sensitive Information Exposure
Details

The MoneySpace plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.13.9. This is due to the plugin storing full payment card details (PAN, card holder name, expiry month/year, and CVV) in WordPress postmeta using base64encode(), and then embedding these values into the publicly accessible mspaylink page's inline JavaScript without any authentication or authorization check. This makes it possible for unauthenticated attackers who know or can guess an order_id to access the mspaylink endpoint and retrieve full credit card numbers and CVV codes directly from the HTML/JS response, constituting a severe PCI-DSS violation.

Database specific 
{
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13371.json",
    "cna_assigner": "Wordfence"
}
References

Affected packages

Git / github.com/moneyspace-net/money-space-for-woocommerce

Affected ranges

Type
GIT
Repo
https://github.com/moneyspace-net/money-space-for-woocommerce
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
20826fbe97936b473f5d61665812360d19af3557
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.13.9"
        }
    ]
}

Affected versions

2.*
2.10.0
2.10.1
2.10.2
2.11.0
2.11.1
2.11.2
2.11.3
2.12.0
2.13.0
2.13.1
2.13.2
2.13.3
2.5.5
2.5.6
2.5.7
2.5.8
2.5.9
2.6.0
2.6.10
2.6.12
2.6.13
2.6.14
2.6.15
2.6.16
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.8.0
2.8.1
2.9.0
v2.*
v2.13.5
v2.13.6
v2.13.8
v2.13.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-13371.json"