CVE-2026-103310
Received Received - Intake

Unauthenticated Payment Forgery in PayHere WordPress Plugin

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: WPScan

Description
The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without payment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-103310

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown PayHere Payment Gateway 2.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The PayHere Payment Gateway WordPress plugin versions 2.4.0 to 2.4.5 has a flaw where payment notifications are not properly verified if the merchant secret is unset, which is the default setting. This allows attackers to forge payment confirmations and mark orders as paid without any actual payment being made.

Detection Guidance

Check if the PayHere Payment Gateway WordPress plugin version is between 2.4.0 and 2.4.5. Inspect network traffic for forged payment confirmations or unauthorized order status changes.

Impact Analysis

This vulnerability allows unauthenticated attackers to trick the system into marking orders as paid without receiving payment. This could lead to financial losses for merchants using the plugin, as orders may appear completed when no money was actually transferred.

Compliance Impact

This vulnerability could lead to unauthorized transactions being recorded as paid, potentially violating financial record-keeping requirements in standards like GDPR (data integrity) and HIPAA (audit controls). Unverified payment confirmations may result in inaccurate financial data, compromising compliance with audit and reporting obligations.

Mitigation Strategies
  • Update the PayHere Payment Gateway plugin to the latest version immediately to patch the vulnerability.
  • Enable and configure the merchant secret in the plugin settings to ensure payment notifications are verified.
  • Monitor order statuses and payment confirmations for any suspicious activity indicating exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103310. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...