Payhere Payment Gateway
Monthly
Unauthenticated order-forgery in the PayHere Payment Gateway WordPress plugin, versions 2.4.0 through 2.4.5, allows an attacker to mark any order as paid without making a payment. The plugin fails to verify the authenticity of incoming payment notifications when the merchant secret is left unset - the default configuration - so a forged confirmation is accepted; sites that have configured a merchant secret are not exploitable. No authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3), impact is confined to order-status integrity with no data disclosure or availability effect, there is no CISA KEV entry, and only a public PoC reference exists that has not been verified as working exploit code; the vulnerability is tracked as a this_month priority item.
The PayHere Payment Gateway WordPress plugin before 2.2.12 automatically creates publicly-accessible log files containing sensitive information when transactions occur. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated order-forgery in the PayHere Payment Gateway WordPress plugin, versions 2.4.0 through 2.4.5, allows an attacker to mark any order as paid without making a payment. The plugin fails to verify the authenticity of incoming payment notifications when the merchant secret is left unset - the default configuration - so a forged confirmation is accepted; sites that have configured a merchant secret are not exploitable. No authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3), impact is confined to order-status integrity with no data disclosure or availability effect, there is no CISA KEV entry, and only a public PoC reference exists that has not been verified as working exploit code; the vulnerability is tracked as a this_month priority item.
The PayHere Payment Gateway WordPress plugin before 2.2.12 automatically creates publicly-accessible log files containing sensitive information when transactions occur. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.