5.3Orta

CVE-2026-103310PayHere Payment Gateway 2.4.0 - 2.4.5 - Unauthenticated Payment Bypass via Unverified Payment Notification

PayHere Payment Gateway Yayım: 2026-11-02 10:10 (5 saat önce)

Açıklama

The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without payment.

Zayıflık türü (CWE): CWE-345

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
—	PayHere Payment Gateway	2.4.0 – ≤ 2.4.5

Kaynaklar ve yamalar

https://wpscan.com/vulnerability/f3b66147-5910-4901-b595-12a5b1db5f8b/ exploitvdb-entrytechnical-description

CVSS puanı

5.3Orta

Kaynak: WPScan · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekmez
Kapsam: Değişmez
Gizlilik: Yok
Bütünlük: Düşük
Erişilebilirlik: Yok

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tüm puanlar (2)

cna	CVSS 3.1	5.3Orta
contact@wpscan.com	CVSS 3.1	5.3Orta

Zaman çizelgesi

Numara ayrıldı2026-09-30
Yayımlandı2026-11-02 10:10
IP-DB'ye ulaştı2026-11-02 11:03
Son güncelleme2026-11-02 11:17

Numarayı veren (CNA): WPScan
NVD durumu: Received

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — WordPress plugins & themes

6.5Orta

CVE-2026-119480 20 saat önce

WordPress JetFormBuilder plugin <= 3.6.7.1 - Attachment Deletion Via Media-Field Preset vulnerability

Crocoblock JetFormBuilder

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Path Traversal.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

7.1Yüksek

CVE-2026-66570 20 saat önce

WordPress WordPress File Upload plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability

Nickboss WordPress File Upload

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.1.

9.3Kritik

CVE-2026-62048 20 saat önce

WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability

Liquid Web / StellarWP BookIt

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6.

5.3Orta

CVE-2026-118168 dün

MapPress Maps for WordPress < 2.97.15 - Unauthenticated Email Address Disclosure

MapPress

The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs.

6.8Orta

CVE-2026-113482 dün

Media Library Assistant < 3.44 - Contributor+ Stored XSS via mla_item_parameter Shortcode Attribute

Media Library Assistant

The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

4.3Orta

CVE-2026-113481 dün

Media Library Assistant < 3.44 - Subscriber+ Missing Authorization via mla-fill-compat-fields

Media Library Assistant

The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assi…