CVE-2025-15475CWE-862

PayHere Payment Gateway Plugin for WooCommerce <= 2.3.9 - Missing Authorization to Unauthenticated Order Status Modification

Medium · published January 14, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
17.0
In the wild
Unconfirmed
What it is

The PayHere Payment Gateway Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improper validation logic in the check_payhere_response function in all versions up to, and including, 2.3.9. This makes it possible for unauthenticated attackers to change the status of pending WooCommerce orders to paid/completed/on hold.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00262 · 17.0th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-01-14T06:40Z
EPSS history
Timeline
  • 14 JAN 06:40Z
    PayHere Payment Gateway Plugin for WooCommerce <= 2.3.9 - Missing Authorization to Unauthenticated Order Status Modification
    cvelistv5