[ CVE-2026-103310 · Published 2 Nov 2026 ]
Vulnerability in Unknown PayHere Payment Gateway
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without payment.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.