CVE-2026-10599

The CVE concerns the Integrate PhonePe with WooCommerce WordPress plugin (versions up to 1.2.1). The root cause is that the plugin does not validate that a verified payment transaction belongs to the order being marked as paid, nor verify the authenticity of the payment-completion request. This a...

CVE-2026-11575 PhonePe Payment Solutions < 3.1.0 - Unauthenticated Payment Bypass via Forged Callback

The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticity of incoming payment callbacks: the secret used to validate the callback signature is empty on sites configured through the current setup flow, so the expected signature reduces to an unkeyed hash...

EUVD-2026-45145

The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticity of incoming payment callbacks: the secret used to validate the callback signature is empty on sites configured through the current setup flow, so the expected signature reduces to an unkeyed hash...