PT-2026-2838 · WordPress+1 · Payhere Payment Gateway Plugin For Woocommerce+1
CVE-2025-15475
·
Publicado
2026-01-14
·
Atualizado
2026-01-14
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
PayHere Payment Gateway Plugin for WooCommerce versions up to and including 2.3.9
Description
The PayHere Payment Gateway Plugin for WooCommerce plugin for WordPress has a flaw where data can be improperly modified. This is due to insufficient validation within the
check payhere response function. An unauthenticated attacker can exploit this to alter the status of pending WooCommerce orders to paid, completed, or on hold.Recommendations
Update to a version beyond 2.3.9.
Correção
Missing Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Payhere Payment Gateway Plugin For Woocommerce
Woocommerce