CVE-2026-103310
Medium · 5.3CVSS
5.3
EPSS
0.1%
Published
Nov 2, 2026
CISA due date
—
The record
The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without payment.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2022-30267 Emerson Ovation was found to have no authentication of firmware signing and relies on an… CWE-345
- CVE-2026-76894 CKAN MCP Server is a tool for querying CKAN open data portals. CWE-345
- CVE-2026-121545 Dreeve before 5.8.0 contains a missing authentication vulnerability in… CWE-345
- CVE-2026-119731 Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its… CWE-345
- CVE-2026-120317 http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability… CWE-345
- CVE-2026-63115 ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. CWE-345
- CVE-2026-119289 Zuke is a code-first, strongly typed build automation system for Deno. CWE-345
- CVE-2026-119422 Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that… CWE-345