The PayHere Payment Gateway plugin for WooCommerce allows an unauthenticated attacker to alter the status of pending orders, changing them to paid, completed or on‑hold. This flaw originates from insecure validation logic in the check_payhere_response function. The resulting impact is an integrity breach that enables an attacker to prematurely mark orders as paid, potentially bypassing payment processing and causing financial loss or fraud.

This vulnerability affects the PayHere Payment Gateway Plugin for WooCommerce, specifically versions 2.3.9 and earlier. Owners of WordPress sites running any version up to 2.3.9 that utilize this plugin are potentially exposed.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% signals a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP request to the plugin’s payment response handler, though the exact method is not detailed in the description. This flaw exposes the order data integrity but does not grant arbitrary command execution or data exfiltration.