# PayHere Payment Gateway <= 2.4.5 - Cross-Site Request Forgery to Saved Card Charge

- **ID:** WPSEC-2026-2170
- **Plugin:** PayHere Payment Gateway (`payhere-payment-gateway`), https://wordpress.org/plugins/payhere-payment-gateway/
- **Affected versions:** all versions before 2.4.6
- **Fixed in:** 2.4.6 (Update to 2.4.6 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-352
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-31)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/payhere-payment-gateway
- **Fix released:** 2026-10-30
- **Published:** 2026-10-31
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2170/

## Description

The PayHere Payment Gateway plugin for WordPress is vulnerable to Cross-Site Request Forgery via the payhere_charge AJAX action (charge_payment() function) in all versions up to, and including, 2.4.5, due to missing nonce validation and missing order ownership, payment method and payment status checks. This makes it possible for unauthenticated attackers to charge the saved PayHere card of a logged-in customer for an arbitrary order (for example, the attacker's own order) and mark that order paid. The attacker must trick the customer into performing an action such as clicking a link. Exploitation requires the customer to have a saved card (tokenizer feature).

## References

- https://wpsec.com/vuln/WPSEC-2026-2170/
- https://plugins.svn.wordpress.org/payhere-payment-gateway/tags/2.4.6/
- https://wordpress.org/plugins/payhere-payment-gateway/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2170/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.