CVE-2026-11575

Name of the Vulnerable Software and Affected Versions PhonePe Payment Solutions WordPress plugin versions prior to 3.1.0

Description Insufficient verification of incoming payment callbacks occurs because the secret used to validate the callback signature remains empty during the standard setup flow. Consequently, the expected signature becomes an unkeyed hash of the request body, which can be calculated by any party. This allows unauthenticated attackers to forge payment-success notifications to mark unpaid WooCommerce orders as paid without actual payment.

Recommendations Update PhonePe Payment Solutions WordPress plugin to version 3.1.0 or later.