CVE-2026-11575

The vulnerability affects the PhonePe Payment Solutions WordPress plugin prior to 3.1.0. The issue is that the secret used to validate the callback signature is empty on sites configured through the current setup flow, causing the expected signature to be an unkeyed hash of the request body. This...