PayHere Payment Gateway <= 2.4.5 - Cross-Site Request Forgery to Saved Card Charge
- ID
- WPSEC-2026-2170
- Plugin
- PayHere Payment Gateway (payhere-payment-gateway)
- Affected
- all versions before 2.4.6
- Remediation
- Update to 2.4.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- Weakness
- CWE-352
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-31
- Attack surface
- PayHere Payment Gateway on WPSec AttackSurface
- Fix released
- Published
Description
The PayHere Payment Gateway plugin for WordPress is vulnerable to Cross-Site Request Forgery via the payhere_charge AJAX action (charge_payment() function) in all versions up to, and including, 2.4.5, due to missing nonce validation and missing order ownership, payment method and payment status checks. This makes it possible for unauthenticated attackers to charge the saved PayHere card of a logged-in customer for an arbitrary order (for example, the attacker's own order) and mark that order paid. The attacker must trick the customer into performing an action such as clicking a link. Exploitation requires the customer to have a saved card (tokenizer feature).
References
- https://wpsec.com/vuln/WPSEC-2026-2170/
- https://plugins.svn.wordpress.org/payhere-payment-gateway/tags/2.4.6/
- https://wordpress.org/plugins/payhere-payment-gateway/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS