CVE-2025-15475
Improper Validation in PayHere Plugin Allows Order Status Manipulation
Publication date: 2026-01-14
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| payhere | payment_gateway_plugin | to 2.3.9 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability can allow attackers to fraudulently change the status of pending orders to paid or completed, potentially leading to unauthorized order fulfillment without actual payment. This can result in financial loss, inventory issues, and disruption of business operations.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to modify the status of WooCommerce orders, potentially leading to unauthorized changes in order data. This could impact data integrity and transaction accuracy, which are important for compliance with standards like GDPR and HIPAA. However, specific effects on compliance with these regulations are not detailed in the provided information.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update the PayHere Payment Gateway Plugin for WooCommerce to a version later than 2.3.9 where the improper validation logic in the check_payhere_response function is fixed. Additionally, review and restrict access to the payment gateway plugin settings and monitor WooCommerce order statuses for unauthorized changes. Consider disabling or restricting the plugin until a patch is applied.
Can you explain this vulnerability to me?
This vulnerability exists in the PayHere Payment Gateway Plugin for WooCommerce for WordPress, specifically in all versions up to and including 2.3.9. It is caused by improper validation logic in the check_payhere_response function, which allows unauthenticated attackers to modify data by changing the status of pending WooCommerce orders to paid, completed, or on hold without proper authorization.