CVE-2026-11575: PhonePe Payment Plugin Auth Bypass Flaw

CVE-2026-11575 Overview

CVE-2026-11575 affects the PhonePe Payment Solutions WordPress plugin in versions prior to 3.1.0. The plugin fails to properly verify the authenticity of incoming payment callbacks. On sites configured through the current setup flow, the secret used to validate the callback signature is empty. The expected signature reduces to an unkeyed hash of the request body that any attacker can compute. Unauthenticated attackers can forge payment-success notifications and mark unpaid WooCommerce orders as paid without making any actual payment. This is a missing authorization flaw tracked as [CWE-862].

Critical Impact
Unauthenticated attackers can forge payment callbacks to convert unpaid WooCommerce orders into paid status, resulting in fulfillment of goods and services without payment.

Affected Products

PhonePe Payment Solutions WordPress plugin versions before 3.1.0
WordPress sites running WooCommerce with the affected plugin
Sites configured through the plugin's current setup flow with an empty callback secret

Discovery Timeline

2026-07-17 - CVE-2026-11575 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-11575

Vulnerability Analysis

The PhonePe Payment Solutions plugin implements a webhook callback handler to receive payment status updates from PhonePe's payment processor. The handler verifies each callback by comparing a signature sent in the request headers against a locally computed value. That local computation is intended to be a keyed hash-based message authentication code (HMAC) using a shared secret negotiated between the merchant and PhonePe.

On installations configured through the plugin's current setup flow, the shared secret is never populated. The verification routine still proceeds, but with an empty key. A keyed hash computed with an empty key degenerates into an unkeyed hash of the request body. Any remote party that knows the hash algorithm and the payload format can reproduce the expected signature.

The callback endpoint is unauthenticated by design so that PhonePe's servers can post payment notifications. Combined with the broken signature check, this yields a network-reachable primitive for forging arbitrary payment-success events. The impact is scoped to order integrity in WooCommerce, matching the CVSS integrity-only vector.

Root Cause

The root cause is a missing authorization check ([CWE-862]) driven by insecure default configuration. The plugin trusts callbacks whose signatures verify with a secret that the setup flow leaves empty. The verification code does not treat an empty secret as an invalid configuration and does not reject callbacks when the key is missing.

Attack Vector

An attacker identifies a target WooCommerce site running the vulnerable plugin and places an order without paying. The attacker then sends a crafted HTTP POST request to the plugin's public callback endpoint. The request body mimics a legitimate PhonePe payment-success notification referencing the target order identifier. The attacker computes an unkeyed hash of the body using the algorithm the plugin expects and includes it as the signature header. The plugin validates the forged signature, marks the order paid, and triggers normal post-payment order processing.

See the WPScan Vulnerability Report for the underlying research.

Detection Methods for CVE-2026-11575

Indicators of Compromise

WooCommerce orders transitioning from pending or on-hold directly to processing or completed without a corresponding PhonePe transaction identifier in merchant records
POST requests to the PhonePe callback endpoint originating from IP addresses outside PhonePe's published callback ranges
Multiple callback requests referencing sequential or enumerated order identifiers within a short window
Order status changes lacking matching entries in the PhonePe merchant dashboard reconciliation logs

Detection Strategies

Reconcile every WooCommerce order marked paid against transaction records in the PhonePe merchant console to surface orders paid on-site but absent upstream
Inspect web server access logs for POST requests to the plugin's callback URL and correlate source IPs with PhonePe's known infrastructure
Alert on any WordPress installation where the PhonePe plugin version is below 3.1.0 and the stored callback secret option is empty

Monitoring Recommendations

Enable verbose logging on WooCommerce order status transitions and forward the events to a centralized log store for review
Monitor for anomalous spikes in successful payment callbacks that are not preceded by a corresponding checkout redirect
Track outbound fulfillment actions such as license key delivery or shipping label creation triggered by orders that lack an authenticated payment record

How to Mitigate CVE-2026-11575

Immediate Actions Required

Update the PhonePe Payment Solutions WordPress plugin to version 3.1.0 or later on all affected sites
Audit WooCommerce orders processed since the plugin was installed and reconcile them against PhonePe transaction records
Verify that the plugin's callback signing secret is populated and matches the value issued in the PhonePe merchant console
Refund or reverse any orders that were marked paid without a matching upstream PhonePe transaction

Patch Information

Upgrade to PhonePe Payment Solutions version 3.1.0 or newer. The fixed release enforces signature verification and rejects callbacks when the shared secret is empty. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable the PhonePe Payment Solutions plugin until it can be updated to 3.1.0 or later
Restrict access to the plugin's callback endpoint at the web server or WAF layer, allowing only PhonePe's documented source IP ranges
Manually confirm each WooCommerce order in the PhonePe merchant console before fulfilling goods or services

bash

# Example nginx location block restricting the callback endpoint to PhonePe source ranges
location ~ ^/wp-json/phonepe/ {
    allow <phonepe-callback-cidr>;
    deny all;
    proxy_pass http://wordpress_backend;
}