PayHere Payment Gateway Plugin for WooCommerce Missing Authorization Vulnerability

A vulnerability exists in the PayHere Payment Gateway Plugin for WooCommerce, specifically in versions through 2.3.9. The issue arises from improper validation in the 'check_payhere_response' function, allowing unauthenticated attackers to modify order statuses. This vulnerability enables the unauthorized change of pending WooCommerce orders to paid, completed, or on-hold statuses.

Impact

Exploitation of this vulnerability allows for unauthorized modification of WooCommerce order statuses, potentially leading to incorrect order management and fulfillment.

Remediation

No known patch is available. It is recommended to review the vulnerability details and consider uninstalling the affected plugin.