CVE-2026-103310
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
71/100
Published: 2026-11-02
Modified: 2026-11-02
First seen: 2026-11-02
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
Unchanged
C:
None
I:
Low
A:
None
Description
The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without payment.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| Unknown | PayHere Payment Gateway | 2.4.0 |
| Unknown | PayHere Payment Gateway | 2.4.0 |
References & Advisories (1)
exploit
vdb-entry
technical-description