CVE-2025-15475

Unknown Unknown - Not Provided

Improper Validation in PayHere Plugin Allows Order Status Manipulation

Publication date: 2026-01-14

Last updated on: 2026-04-08

Assigner: Wordfence

Description

The PayHere Payment Gateway Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improper validation logic in the check_payhere_response function in all versions up to, and including, 2.3.9. This makes it possible for unauthenticated attackers to change the status of pending WooCommerce orders to paid/completed/on hold.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-14

Last Modified

2026-04-08

Generated

2026-07-06

AI Q&A

2026-01-14

EPSS Evaluated

2026-07-05

NVD

CVE-2025-15475

EUVD

EUVD-2026-2529

Affected Vendors & Products

Vendor	Product	Version / Range
payhere	payment_gateway_plugin	to 2.3.9 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Compliance Impact

The vulnerability allows unauthenticated attackers to modify the status of WooCommerce orders, potentially leading to unauthorized changes in order data. This could impact data integrity and transaction accuracy, which are important for compliance with standards like GDPR and HIPAA. However, specific effects on compliance with these regulations are not detailed in the provided information.

Impact Analysis

The vulnerability can allow attackers to fraudulently change the status of pending orders to paid or completed, potentially leading to unauthorized order fulfillment without actual payment. This can result in financial loss, inventory issues, and disruption of business operations.

Mitigation Strategies

To mitigate this vulnerability, immediately update the PayHere Payment Gateway Plugin for WooCommerce to a version later than 2.3.9 where the improper validation logic in the check_payhere_response function is fixed. Additionally, review and restrict access to the payment gateway plugin settings and monitor WooCommerce order statuses for unauthorized changes. Consider disabling or restricting the plugin until a patch is applied.

Executive Summary

This vulnerability exists in the PayHere Payment Gateway Plugin for WooCommerce for WordPress, specifically in all versions up to and including 2.3.9. It is caused by improper validation logic in the check_payhere_response function, which allows unauthenticated attackers to modify data by changing the status of pending WooCommerce orders to paid, completed, or on hold without proper authorization.

Hi! I’m here to help you understand CVE-2025-15475. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70