CVE-2025-15475: 
WordPress vulnerability analysis and mitigation

CVE-2025-15475 is a Missing Authorization vulnerability in the PayHere Payment Gateway Plugin for WooCommerce (WordPress plugin) that allows unauthenticated attackers to fraudulently alter WooCommerce order statuses. The flaw exists in all versions up to and including 2.3.9, affecting the check_payhere_response function due to improper validation logic. It was published on January 14, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Wordfence (Wordfence).

The root cause is classified as CWE-862 (Missing Authorization), specifically an improper validation logic flaw within the check_payhere_response function in class-wcgatewaypayhere.php (line 709 in version 2.3.9). Because the function does not properly verify the authenticity or authorization of incoming payment callback requests, an unauthenticated remote attacker can send crafted HTTP requests to manipulate pending WooCommerce order statuses to paid, completed, or on-hold without completing an actual payment. No authentication or special privileges are required, and user interaction is not needed (Wordfence, Plugin Source).

Successful exploitation allows unauthenticated attackers to fraudulently mark WooCommerce orders as paid or completed without making an actual payment, directly impacting the integrity of e-commerce transactions on affected WordPress sites. This can result in financial losses for merchants, as goods or services may be dispatched without legitimate payment. There is no confidentiality or availability impact; the risk is limited to unauthorized data modification of order records (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-15475 as of the available data. The EPSS score is approximately 0.028% (0.000280), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

1. Reconnaissance: Identify WordPress sites using the PayHere Payment Gateway Plugin for WooCommerce (versions ≤ 2.3.9) by scanning for plugin-specific indicators (e.g., plugin directory paths or payment gateway references in page source).
2. Identify the callback endpoint: Locate the WooCommerce payment notification/callback URL used by the PayHere plugin, typically a WooCommerce IPN (Instant Payment Notification) or webhook endpoint registered by the plugin.
3. Craft a malicious callback request: Construct an HTTP POST request mimicking a legitimate PayHere payment notification, targeting the check_payhere_response function. Due to the missing authorization check, the request does not need to include valid payment credentials or a verified signature.
4. Specify target order: Include a valid WooCommerce order ID (obtainable via order confirmation emails or guest checkout flows) and set the payment status to 'paid', 'completed', or 'on-hold' in the request parameters.
5. Submit the request: Send the crafted request to the callback endpoint. The plugin processes it without proper authorization validation, updating the order status as specified — effectively marking an unpaid order as paid (Wordfence, Plugin Source).

• Network: Unexpected POST requests to the WooCommerce PayHere callback/IPN endpoint from IP addresses not associated with PayHere's payment gateway servers; high volume of callback requests for the same or multiple order IDs.
• Logs: WordPress/WooCommerce access logs showing repeated POST requests to the PayHere response handler endpoint (e.g., /?wc-api=WC_Gateway_Payhere or similar) from unknown or suspicious IP addresses; order status change events in WooCommerce logs without corresponding legitimate payment records.
• Application: WooCommerce orders transitioning from 'pending' to 'paid', 'completed', or 'on-hold' without a matching payment transaction in the PayHere merchant dashboard; orders fulfilled without corresponding revenue in payment processor records.

Users should update the PayHere Payment Gateway Plugin for WooCommerce to a version beyond 2.3.9, which contains the fix for the improper validation logic in check_payhere_response. A patch changeset is available in the WordPress plugin repository (Plugin Changeset). As a temporary workaround, site administrators can restrict access to the PayHere callback endpoint via web server rules (e.g., allowlisting PayHere's known IP ranges) until the plugin is updated. Regularly auditing WooCommerce order status changes against actual payment records is also recommended (Wordfence).

The vulnerability was reported and disclosed by Wordfence, which assigned the CVSS score and published the threat intelligence entry. Coverage has been limited to automated vulnerability aggregators and security feeds such as VulDB, Vulners, and INCIBE-CERT, with no notable researcher commentary or significant social media discussion identified beyond routine CVE tracking (Wordfence).