---
id: "CVE-2026-103310"
kind: "vulnerability"
aliases: ["CVE-2026-103310"]
title: "PayHere WordPress plugin: forged payment notices mark orders paid"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ecommerce", "package", "payhere", "woocommerce", "wordpress"]
not_affected_if: ["merchant-secret-set", "other-version"]
published_at: "2026-11-02T08:17:35+00:00"
first_seen_at: "2026-11-02T08:22:13+00:00"
updated_at: "2026-11-02T08:22:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103310", "first_seen_at": "2026-11-02T08:22:13+00:00"}]
---

# PayHere WordPress plugin: forged payment notices mark orders paid

The PayHere Payment Gateway WordPress plugin versions 2.4.0 through 2.4.5 does not check that payment notifications are genuine when the merchant secret is unset, which is the default. An unauthenticated attacker can send a forged payment confirmation and mark any order as paid without paying.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed PayHere Payment Gateway plugin version in the WordPress admin under Plugins; affected versions are `2.4.0` through `2.4.5`.
- Check whether the merchant secret is set in the plugin's payment gateway settings; the flaw applies when it is unset.

## Fix

- PayHere Payment Gateway plugin: unknown fixed version in the sources; move past `2.4.5` once a patched release is confirmed.

## Timeline

- 2026-11-02T08:22:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103310

## From the sources

The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without payment.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_