CVE-2026-103310 PayHere CVE debrief

Who should care

Defenders managing WordPress sites using the PayHere Payment Gateway plugin should assess exposure and verify the plugin version to prevent potential payment forgery. WordPress site administrators and security teams should also review the plugin configuration and ensure that the merchant secret is set and configured properly to prevent potential payment forgery and financial loss. Additionally, defenders should prioritize verifying and updating the plugin,

Why it matters

Defenders should care about CVE-2026-103310 as it allows unauthenticated attackers to forge payment confirmations in the PayHere Payment Gateway WordPress plugin, potentially leading to financial loss and compromised payment integrity. WordPress site administrators and security teams should verify and update the plugin to prevent potential payment forgery.

• Potential payment forgery and financial loss.
• Compromised payment integrity and order status.

Technical summary

The PayHere Payment Gateway WordPress plugin, versions 2.4.0 through 2.4.5, does not verify the authenticity of payment notifications when the merchant secret is unset, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without payment. This vulnerability can be exploited by unauthenticated attackers, potentially leading to financial loss and compromised payment integrity. The issue arises from the default state of the merchant secret being unset, which allows attackers to forge payment confirmations.

Defensive priority

Defenders should prioritize verifying and updating the plugin to prevent potential payment forgery.

Recommended defensive actions

• Verify the PayHere Payment Gateway WordPress plugin version and update to a fixed version if necessary.
• Check if the merchant secret is set and configured properly.
• Monitor payment notifications for potential forgery attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability exists in PayHere Payment Gateway WordPress plugin versions 2.4.0 through 2.4.5. The merchant secret being unset by default allows unauthenticated attackers to forge payment confirmations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.