What is the CVSS score of CVE-2026-11575?

CVE-2026-11575 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of PhonePe Payment Solutions are affected by CVE-2026-11575?

PhonePe Payment Solutions plugin (WordPress/WooCommerce) versions before 3.1.0 allow unauthenticated attackers to forge payment confirmations and mark unpaid orders as completed.. A patch is available.

Is there a public PoC exploit available for CVE-2026-11575?

Yes, a public proof-of-concept exploit is available for CVE-2026-11575. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-11575?

Within 24 hours, identify all WooCommerce installations using PhonePe Payment Solutions plugin versions prior to 3.1.0 and pause payment processing if operationally feasible. Within 7 days, upgrade the plugin to version 3.1.0 or later across all affected instances. Within 30 days, audit payment logs and order records for suspicious callback signatures, reverse any fraudulent orders, and verify callback-validation secrets are properly configured in all payment configurations.

PhonePe Payment Solutions CVE-2026-11575

EUVD-2026-45145 HIGH

Missing Authorization (CWE-862)

2026-07-17 WPScan

GHSA-vf96-qpw4-cqjr

WordPress Authentication Bypass Phonepe Payment Solutions Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network callback with trivial signature forgery gives AV:N/AC:L/PR:N/UI:N; impact is falsifying paid status, so I:H and C:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 10:01 vuln.today

Patch available

Jul 17, 2026 - 08:02 EUVD

CVE Published

Jul 17, 2026 - 06:00 cve.org

HIGH 7.5

CVE Published

Jul 17, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticity of incoming payment callbacks: the secret used to validate the callback signature is empty on sites configured through the current setup flow, so the expected signature reduces to an unkeyed hash of the request body that anyone can compute. This allows unauthenticated attackers to forge a payment-success notification and mark unpaid WooCommerce orders as paid without any payment being made.

AnalysisAI

Payment authentication bypass in the PhonePe Payment Solutions WordPress/WooCommerce plugin before 3.1.0 lets unauthenticated attackers forge payment-success callbacks and mark unpaid orders as paid. Because sites set up through the current onboarding flow have an empty callback-validation secret, the expected signature collapses to an unkeyed hash of the request body that anyone can reproduce. Publicly available exploit code exists (reported by WPScan), though EPSS is low (0.14%) and there is no public exploit identified as being used in the wild.

Technical ContextAI

The plugin integrates the PhonePe payment gateway into WooCommerce and relies on server-to-server callback notifications to confirm that an order has been paid. Payment gateways normally sign these callbacks with a shared secret (an HMAC) so the merchant can verify authenticity. Here the secret is empty for sites configured via the current setup flow, meaning signature verification degenerates from a keyed HMAC into a plain unkeyed hash of the raw request body that any party can compute without knowing any secret. This is a classic CWE-862 missing-authorization / broken-authenticity check: the endpoint accepts state-changing input without a trustworthy way to prove it originated from PhonePe. The affected component is identified by CPE cpe:2.3:a:unknown:phonepe_payment_solutions and covers all versions prior to 3.1.0.

RemediationAI

Vendor-released patch: upgrade the PhonePe Payment Solutions plugin to version 3.1.0 or later, which corrects callback-signature validation so an empty/unkeyed secret is no longer accepted; see the WPScan advisory at https://wpscan.com/vulnerability/e35eb029-87c3-4837-87c1-4ad7f6f5817f/. Until patching, treat completed WooCommerce orders as untrusted and reconcile them against PhonePe's own merchant dashboard/settlement reports before fulfilling, and re-run the plugin setup to ensure a non-empty callback secret/salt is actually populated (the root cause is the empty secret). As a compensating control you can restrict the callback endpoint at the web server or WAF so it only accepts requests from PhonePe's published callback IP ranges - this blocks arbitrary forgers but will silently drop legitimate callbacks if PhonePe changes source IPs, so monitor for missed confirmations. Do not rely on order status alone for fulfillment while unpatched.