The PhonePe Payment Solutions WordPress plugin before version 3.1.0 does not verify the authenticity of incoming payment callbacks because the secret used to validate the callback signature is empty when sites are configured via its default setup flow. The expected signature therefore collapses to an unkeyed hash of the request body, which any attacker can compute. As a result, an unauthenticated attacker can craft a payment‑success notification and cause the plugin to mark unpaid WooCommerce orders as paid, even though no payment has actually been made. This flaw enables direct payment fraud and financial loss.

WordPress sites that have installed the PhonePe Payment Solutions plugin with a version older than 3.1.0 are affected. The issue manifests on any installation that relies on the plugin’s default callback authentication mechanism, particularly those processing WooCommerce orders.

The CVSS score of 7.5 indicates high severity, but the EPSS score of <1% suggests that exploitation is unlikely at present. The flaw is not listed in the CISA KEV catalog. Attackers can exploit this vulnerability by sending a forged HTTP callback request to the site’s callback endpoint over the network, without any authentication or prior compromise required.