# CVE-2026-103310: PayHere Payment Gateway 2.4.0 - 2.4.5 - Unauthenticated Payment Bypass via Unverified Payment Notification

Status: published. Published: 2026-11-02. Updated: 2026-11-02.

The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without payment.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Unknown / PayHere Payment Gateway: ≥ 2.4.0; ≤ 2.4.5 (affected, semver). Source: CNA: WPScan

## Severity and prioritization

- CVSS 3.1: 5.3 (medium); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N; source: CNA: WPScan

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-345

## Exploit evidence

- exploit: https://wpscan.com/vulnerability/f3b66147-5910-4901-b595-12a5b1db5f8b/ (CNA: WPScan)

## References

- https://wpscan.com/vulnerability/f3b66147-5910-4901-b595-12a5b1db5f8b/ (CNA: WPScan; exploit, vdb-entry, technical-description)

## Provenance

- CNA: WPScan: https://www.cve.org/CVERecord?id=CVE-2026-103310; retrieved 2026-11-02; source updated 2026-11-02

Revision: f7fda92dc5a783e5496e72185839e2cdac0d2a471a0ebae39ac99c0996805012

Canonical: https://y2.dev/cve/CVE-2026-103310