CVE-2026-103310

Publié : 2 novembre 2026

Modifié : 2 novembre 2026

Score CVSS

5.3

MEDIUM

Description détaillée

The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without payment.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Références et Patchs

https://wpscan.com/vulnerability/f3b66147-5910-4901-b595-12a5b1db5f8b/

Dernières Vulnérabilités

CVE-2026-107457

A memory corruption vulnerability in the QMqttClient class of the Qt MQTT module. Under certain MQTT 5 connection settings between client and server, QMqttClient may corrupt memory, which can cause the application to crash.

VOIR DÉTAILS

CVE-2026-18199

Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an authenticated Remote Code Execution vulnerability.

VOIR DÉTAILS

CVE-2026-101184

Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect availability.

VOIR DÉTAILS