{"id":"CVE-2026-103310","kind":"vulnerability","aliases":["CVE-2026-103310"],"related":[],"title":"PayHere WordPress plugin: forged payment notices mark orders paid","description":"The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without payment.","summary":"The PayHere Payment Gateway WordPress plugin versions 2.4.0 through 2.4.5 does not check that payment notifications are genuine when the merchant secret is unset, which is the default. An unauthenticated attacker can send a forged payment confirmation and mark any order as paid without paying.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","payhere","woocommerce","wordpress"],"not_affected_if":["merchant-secret-set","other-version"],"how_to_check":"- Check the installed PayHere Payment Gateway plugin version in the WordPress admin under Plugins; affected versions are `2.4.0` through `2.4.5`.\n- Check whether the merchant secret is set in the plugin's payment gateway settings; the flaw applies when it is unset.","fix":"- PayHere Payment Gateway plugin: unknown fixed version in the sources; move past `2.4.5` once a patched release is confirmed.","status":"open","published_at":"2026-11-02T08:17:35+00:00","first_seen_at":"2026-11-02T08:22:13+00:00","triaged_at":"2026-11-02T08:22:41+00:00","updated_at":"2026-11-02T08:22:41+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-02T08:22:41Z","model":"claude-haiku-5-5","output":{"fix":"- PayHere Payment Gateway plugin: unknown fixed version in the sources; move past `2.4.5` once a patched release is confirmed.","reach":"internet","title":"PayHere WordPress plugin: forged payment notices mark orders paid","impact":"medium","summary":"The PayHere Payment Gateway WordPress plugin versions 2.4.0 through 2.4.5 does not check that payment notifications are genuine when the merchant secret is unset, which is the default. An unauthenticated attacker can send a forged payment confirmation and mark any order as paid without paying.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","payhere","ecommerce"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker marks orders paid without payment, causing fulfilment losses.","analyst_note":"Find the patched PayHere plugin version and confirm the default merchant secret behaviour at https://nvd.nist.gov/vuln/detail/CVE-2026-103310.","how_to_check":"- Check the installed PayHere Payment Gateway plugin version in the WordPress admin under Plugins; affected versions are `2.4.0` through `2.4.5`.\n- Check whether the merchant secret is set in the plugin's payment gateway settings; the flaw applies when it is unset.","plain_action":"","needs_analyst":true,"not_affected_if":["merchant-secret-set","other-version"],"who_is_affected":"Stores running the PayHere Payment Gateway WordPress plugin between 2.4.0 and 2.4.5 with no merchant secret configured are exposed, because the plugin accepts payment notifications without verifying them. Sites that use a different gateway, run a version outside that range, or have the merchant secret set are not described as affected by the sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000752,"input_tokens":4137,"output_tokens":677,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-103310':12A,15A '-2026':11A,14A '2.4.0':28B,73C '2.4.5':30B,75C 'allow':95C 'attack':51B,97C 'authent':80C 'check':33B 'confirm':57B,102C 'cve':10A,13A 'default':48B,93C 'ecommerc':16B 'forg':4A,55B,99C 'gateway':24B,69C 'genuin':38B 'mark':7A,59B,104C 'merchant':41B,86C 'notic':6A 'notif':36B,83C 'order':8A,61B,106C 'packag':17B 'paid':9A,63B,108C 'pay':65B 'payher':1A,18B,22B,67C 'payment':5A,23B,35B,56B,68C,82C,101C,110C 'plugin':3A,26B,71C 'secret':42B,87C 'send':53B 'state':94C 'unauthent':50B,96C 'unset':44B,89C 'verifi':78C 'version':27B 'without':64B,109C 'woocommerc':19B 'wordpress':2A,20B,25B,70C","nicknames":[],"mitigations":[],"who_affected":"Stores running the PayHere Payment Gateway WordPress plugin between 2.4.0 and 2.4.5 with no merchant secret configured are exposed, because the plugin accepts payment notifications without verifying them. Sites that use a different gateway, run a version outside that range, or have the merchant secret set are not described as affected by the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ecommerce","medium","package","payhere","woocommerce","wordpress"],"first_public_at":"2026-11-02T08:17:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103310","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103310","severity":null,"published_at":"2026-11-02T08:17:35+00:00","modified_at":"2026-11-02T08:17:35+00:00","first_seen_at":"2026-11-02T08:22:13+00:00","fetched_at":"2026-11-02T08:22:13+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}