PT-2026-2838 · Payhere · Payhere Payment Gateway Plugin For Woocommerce

Published 2026-01-14 · Updated 2026-01-14 · CVE-2025-15475

NVD

CVSS v3.1

5.3

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

The PayHere Payment Gateway Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improper validation logic in the check payhere response function in all versions up to, and including, 2.3.9. This makes it possible for unauthenticated attackers to change the status of pending WooCommerce orders to paid/completed/on hold.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-15475

Affected Products

Payhere Payment Gateway Plugin For Woocommerce

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-15475 · Security Note
• https://plugins.trac.wordpress.org/browser/payhere-payment-gateway/tags/2.3.9/gateway/class-wcgatewaypayhere.php#L709 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e0c92241-0bef-4f87-8478-4d805435f09d?source=cve · Note