CVE-2025-15475: PayHere WooCommerce Auth Bypass Flaw

CVE-2025-15475 Overview

CVE-2025-15475 is an Authorization Bypass vulnerability affecting the PayHere Payment Gateway Plugin for WooCommerce on WordPress. The vulnerability exists due to improper validation logic in the check_payhere_response function, allowing unauthenticated attackers to manipulate WooCommerce order statuses without proper authorization checks.

This flaw enables remote attackers to change the status of pending WooCommerce orders to paid, completed, or on hold without authentication. E-commerce sites using this plugin are at risk of fraudulent order processing, potentially leading to financial losses and inventory discrepancies.

Critical Impact

Unauthenticated attackers can manipulate WooCommerce order statuses, potentially marking unpaid orders as paid/completed, leading to fraudulent order fulfillment and financial losses for e-commerce businesses.

Affected Products

• PayHere Payment Gateway Plugin for WooCommerce versions up to and including 2.3.9
• WordPress sites running vulnerable versions of the PayHere Payment Gateway Plugin
• WooCommerce stores integrated with PayHere payment processing

Discovery Timeline

• 2026-01-14 - CVE CVE-2025-15475 published to NVD
• 2026-01-14 - Last updated in NVD database

Technical Details for CVE-2025-15475

Vulnerability Analysis

The vulnerability resides in the check_payhere_response function within the class-wcgatewaypayhere.php file. This function is responsible for processing payment callback responses from the PayHere payment gateway. The improper validation logic fails to adequately verify the authenticity and authorization of incoming requests before modifying order statuses.

The core issue is classified under CWE-862 (Missing Authorization), indicating that the function lacks proper authorization checks to ensure that only legitimate payment gateway callbacks can modify order data. An attacker can craft malicious requests that bypass the validation logic and directly manipulate order statuses within the WooCommerce database.

The attack is network-accessible, requires no user interaction, and can be exploited by unauthenticated users, making it particularly dangerous for publicly accessible WordPress e-commerce sites.

Root Cause

The root cause is a Missing Authorization vulnerability (CWE-862) in the payment callback handler. The check_payhere_response function at line 709 of class-wcgatewaypayhere.php does not properly validate that incoming payment notification requests originate from the legitimate PayHere payment gateway infrastructure. This allows attackers to forge callback requests and manipulate order data.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying WordPress sites using the PayHere Payment Gateway Plugin
2. Crafting malicious HTTP requests that mimic PayHere payment callback notifications
3. Sending these forged requests to the vulnerable endpoint
4. Manipulating order statuses to mark unpaid orders as paid or completed

The vulnerability allows attackers to bypass normal payment verification processes, potentially enabling order fraud where products or services are fulfilled without actual payment being received.

Detection Methods for CVE-2025-15475

Indicators of Compromise

• Unexpected changes to WooCommerce order statuses from pending to paid/completed without corresponding payment records
• Unusual HTTP requests to the PayHere callback endpoint from non-PayHere IP addresses
• Discrepancies between payment gateway transaction logs and WooCommerce order statuses
• Multiple orders being marked as completed in rapid succession without legitimate payment confirmations

Detection Strategies

• Monitor WooCommerce order status change events and correlate with actual payment gateway transaction confirmations
• Implement Web Application Firewall (WAF) rules to detect and block malicious callback requests
• Review server access logs for suspicious requests to the PayHere callback handler endpoint
• Set up alerts for bulk order status changes that occur without corresponding payment processor activity

Monitoring Recommendations

• Enable detailed logging for the WooCommerce order management system to track all status modifications
• Configure real-time monitoring for the PayHere callback endpoint to detect anomalous request patterns
• Implement financial reconciliation processes to identify orders marked as paid without actual payment
• Deploy SentinelOne Singularity for endpoint monitoring to detect and alert on exploitation attempts

How to Mitigate CVE-2025-15475

Immediate Actions Required

• Update the PayHere Payment Gateway Plugin for WooCommerce to the latest patched version immediately
• Audit recent WooCommerce order status changes for signs of unauthorized modifications
• Temporarily disable the PayHere Payment Gateway Plugin if an update is not immediately available
• Implement additional authorization checks at the web server or WAF level for callback endpoints
• Review payment gateway transaction logs and reconcile with current order statuses

Patch Information

Organizations should update to a version of the PayHere Payment Gateway Plugin that addresses this authorization bypass vulnerability. The vulnerability affects all versions up to and including 2.3.9. Check the WordPress Plugin Repository and the Wordfence Vulnerability Analysis for the latest security updates and patched versions.

Workarounds

• Implement IP allowlisting at the web server level to only accept PayHere callback requests from official PayHere IP addresses
• Add custom validation logic to verify payment signatures before processing callback requests
• Configure a Web Application Firewall (WAF) rule to inspect and validate PayHere callback request parameters
• Implement a secondary payment verification step by querying the PayHere API to confirm transaction authenticity before updating order statuses