Executive brief
The PhonePe Payment Solutions plugin for WordPress, which enables businesses to accept payments via the PhonePe gateway, contains a flaw in how it verifies successful transactions. Due to a configuration error in the setup process, the plugin fails to properly validate digital signatures on payment notifications. This allows an attacker to trick the website into marking orders as 'paid' without actually transferring any money, potentially leading to significant financial loss and unauthorized fulfillment of goods or services.
Technical details
The vulnerability exists in the payment callback handling logic of the PhonePe Payment Solutions plugin. In versions prior to 3.1.0, sites configured through the standard setup flow may have an empty secret key used for signature validation. Consequently, the expected HMAC or keyed hash reduces to a simple unkeyed hash of the request body. An unauthenticated remote attacker can calculate this hash, forge a 'payment-success' callback, and submit it to the plugin's endpoint. This results in unpaid WooCommerce orders being transitioned to a 'paid' or 'processing' status. The issue is resolved in version 3.1.0 by ensuring proper signature verification.
Affected products
- PhonePe PhonePe Payment Solutions < 3.1.0
Timeline
- 2026-06-26: disclosed: Publicly published by WPScan
- 2026-07-17: advisory: NVD publication date
- 2026-06-26: patched: Fix available in version 3.1.0