The PhonePe Payment Solutions WordPress plugin contains a critical authentication flaw that allows remote, unauthenticated attackers to spoof payment confirmations.

This vulnerability involves a missing authorization check where the secret used to validate payment callbacks is empty in specific configurations. This allows an unauthenticated attacker to compute a valid hash and forge successful payment callbacks for unpaid orders.

The vulnerability carries a CVSS score of 7.5, reflecting a high severity due to the impact on data integrity. Successful exploitation allows attackers to mark unpaid WooCommerce orders as paid without an actual financial transaction, leading to direct financial loss and inventory mismanagement.

Immediate Action: Update the PhonePe Payment Solutions plugin to version 3.1.0 or later immediately.

Proactive Monitoring: Review WooCommerce order logs for transactions marked as paid that lack corresponding payment records or verification from the payment gateway.

Compensating Controls: If immediate patching is not possible, implement strict access controls on the callback endpoint via a Web Application Firewall to restrict traffic to known payment gateway IP addresses.

Public Exploit Available: No (as of July 20, 2026, there is no confirmed public weaponized exploit).

This vulnerability presents a significant risk to e-commerce operations by directly impacting the financial integrity of the transaction process. Administrators must prioritize updating to version 3.1.0 to close the signature validation gap and prevent unauthorized order status modifications.