Live › vulnerability › CVE-2026-103310
The PayHere Payment Gateway WordPress plugin versions 2.4.0 through 2.4.5 does not check that payment notifications are genuine when the merchant secret is unset, which is the default. An unauthenticated attacker can send a forged payment confirmation and mark any order as paid without paying.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 08:22 UTC. All times on this page are UTC.
Stores running the PayHere Payment Gateway WordPress plugin between 2.4.0 and 2.4.5 with no merchant secret configured are exposed, because the plugin accepts payment notifications without verifying them. Sites that use a different gateway, run a version outside that range, or have the merchant secret set are not described as affected by the sources.
No product ranges from the sources yet.
2.4.0 through 2.4.5.2.4.5 once a patched release is confirmed.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without payment.
This page as .md · .json · in your agent: get_signal("CVE-2026-103310")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.