PT-2026-2838 · WordPress+1 · Payhere Payment Gateway Plugin For Woocommerce+1

Published 2026-01-14 · Updated 2026-01-14 · CVE-2025-15475

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions PayHere Payment Gateway Plugin for WooCommerce versions up to and including 2.3.9

Description The PayHere Payment Gateway Plugin for WooCommerce plugin for WordPress has a flaw where data can be improperly modified. This is due to insufficient validation within the check payhere response function. An unauthenticated attacker can exploit this to alter the status of pending WooCommerce orders to paid, completed, or on hold.

Recommendations Update to a version beyond 2.3.9.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-15475

Affected Products

Payhere Payment Gateway Plugin For Woocommerce

Woocommerce

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-15475 · Security Note
• https://twitter.com/VulmonFeeds/status/2011370020815745133 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3440771%40payhere-payment-gateway&new=3440771%40payhere-payment-gateway&sfp_email=&sfph_mail=#file10 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e0c92241-0bef-4f87-8478-4d805435f09d?source=cve · Note
• https://plugins.trac.wordpress.org/browser/payhere-payment-gateway/tags/2.3.9/gateway/class-wcgatewaypayhere.php#L709 · Note
• https://twitter.com/CVEnew/status/2011382968325976435 · Twitter Post