{
 "id": "WPSEC-2026-2170",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2170/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2170/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2170/index.md",
 "title": "PayHere Payment Gateway <= 2.4.5 - Cross-Site Request Forgery to Saved Card Charge",
 "description": "The PayHere Payment Gateway plugin for WordPress is vulnerable to Cross-Site Request Forgery via the payhere_charge AJAX action (charge_payment() function) in all versions up to, and including, 2.4.5, due to missing nonce validation and missing order ownership, payment method and payment status checks. This makes it possible for unauthenticated attackers to charge the saved PayHere card of a logged-in customer for an arbitrary order (for example, the attacker's own order) and mark that order paid. The attacker must trick the customer into performing an action such as clicking a link. Exploitation requires the customer to have a saved card (tokenizer feature).",
 "plugin": {
  "slug": "payhere-payment-gateway",
  "name": "PayHere Payment Gateway",
  "full_name": "PayHere Payment Gateway",
  "wordpress_org": "https://wordpress.org/plugins/payhere-payment-gateway/",
  "advisories_url": "https://wpsec.com/vuln/plugin/payhere-payment-gateway/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/payhere-payment-gateway"
 },
 "type": "CSRF",
 "cwe": [
  "CWE-352"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.4.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.4.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.4.6",
 "remediation": "Update to 2.4.6 or later.",
 "fix_released": "2026-10-30T05:35:13+00:00",
 "published": "2026-10-31T05:41:52+00:00",
 "updated": "2026-10-30T09:24:49.390919+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2170/",
  "https://plugins.svn.wordpress.org/payhere-payment-gateway/tags/2.4.6/",
  "https://wordpress.org/plugins/payhere-payment-gateway/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/payhere-payment-gateway",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-31"
 }
}