CVE-2025-15475: Missing Authorization

The PayHere Payment Gateway Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improper validation logic in the checkpayhereresponse function in all versions up to, and including, 2.3.9. This makes it possible for unauthenticated attackers to...

CVE-2023-6064

The PayHere Payment Gateway WordPress plugin before 2.2.12 automatically creates publicly-accessible log files containing sensitive information when transactions occur...

CVE-2023-6064

The PayHere Payment Gateway WordPress plugin before 2.2.12 automatically creates publicly-accessible log files containing sensitive information when transactions occur...

CVE-2023-6064 PayHere Payment Gateway < 2.2.12 - Unauthenticated Log Data Disclosure

The PayHere Payment Gateway WordPress plugin before 2.2.12 automatically creates publicly-accessible log files containing sensitive information when transactions occur...

CVE-2023-6064

The PayHere Payment Gateway WordPress plugin contains an unauthenticated information-disclosure vulnerability in versions prior to 2.2.12. The root cause is the automatic creation of publicly accessible log files containing sensitive transaction data, leading to potential exposure of confidential...

PT-2024-14870 · WordPress · Payhere Payment Gateway

Name of the Vulnerable Software and Affected Versions: PayHere Payment Gateway WordPress plugin versions prior to 2.2.12 Description: The issue arises from the automatic creation of publicly-accessible log files containing sensitive information when transactions occur. This affects the PayHere...

PayHere Payment Gateway < 2.2.12 - Unauthenticated Log Data Disclosure

Description The plugin automatically creates publicly-accessible log files containing sensitive information when transactions occur. PoC https://www.suppliment.lk/wp-content/uploads/payhere-logs/?SD https://www.medic.lk/wp-content/uploads/payhere-logs/?SD...