PT-2026-135355

CVE-2026-103310

Published

2026-10-29

Updated

2026-11-06

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions PayHere Payment Gateway WordPress plugin versions 2.4.0 through 2.4.5

Description This issue occurs because the plugin fails to verify the authenticity of payment notifications when the merchant secret is unset, which is the default configuration. This lack of server-side payment verification allows unauthenticated attackers to forge payment confirmations and mark orders as paid without completing the actual transaction.

Recommendations Update PayHere Payment Gateway WordPress plugin to a version later than 2.4.5.

Exploitability

Exploit

Fix

Impacts

Researchers

Naoki Kawahigashi

Vendors

Affected products

Weakness enumeration

CWE-345: Insufficient Verification of Data Authenticity

Related identifiers