PayHere Payment Gateway

PayHere Payment Gateway has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 2 are fixed as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.

The most common weakness is Exposure Of Sensitive Information To An Unauthorized Actor, behind 1 of the records (50%). Other recurring categories include Missing Authorization.

Every one of the 2 issues recorded for PayHere Payment Gateway has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each.

01234567891007.12.2023Today07.12.20235.3PayHere Payment Gateway <= 2.2.11 - Information Disclosure via Log Files CVSS 5.3 · 07.12.202313.01.20265.3PayHere Payment Gateway Plugin for WooCommerce <= 2.3.9 - Missing Authorization to Unauthenticated Order Status Modification CVSS 5.3 · 13.01.2026

Strategic Overview

Avg CVSSMedium
5.3/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all PayHere Payment Gateway vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.3CVE-2025-15475

PayHere Payment Gateway Plugin for WooCommerce <= 2.3.9 - Missing Authorization to Unauthenticated Order Status Modification

Read the full analysis

Vulnerability Records

2 records
Showing 1–2 of 2 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C