Authentication Bypass in PhonePe Payment Solutions WordPress Plugin
CVE-2026-11575

7.5HIGH

Key Information:

Vendor

WordPress
Status
Phonepe Payment Solutions
Vendor
CVE Published:
17 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-11575?

The PhonePe Payment Solutions WordPress plugin versions prior to 3.1.0 fails to adequately verify the authenticity of incoming payment callbacks. This vulnerability arises when sites are configured through the current setup flow, leading to an empty secret for validating callback signatures. Consequently, the signature can be easily forged, permitting unauthorized attackers to generate fraudulent payment-success notifications, thereby marking unpaid WooCommerce orders as paid without any actual transaction occurring. This can result in significant financial loss and undermines the integrity of the payment processing system.

Affected Version(s)

PhonePe Payment Solutions 0 < 3.1.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-11575 - Proof of Concept

References

https://wpscan.com/vulnerability/e35eb029-87c3-4837-87c1-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Akshat Parikh (SN1PER)
WPScan
.