PhonePe WordPress Plugin Payment Callback Authentication Bypass

The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticity of incoming payment callbacks: the secret used to validate the callback signature is empty on sites configured through the current setup flow, so the expected signature reduces to an unkeyed hash of the request body that anyone can compute. This allows unauthenticated attackers to forge a payment-success notification and mark unpaid WooCommerce orders as paid without any payment being made.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-11575 represents a critical authentication failure in the PhonePe Payment Solutions WordPress plugin versions before 3.1.0. The vulnerability stems from improper verification of payment callbacks—specifically, the cryptographic secret used to validate callback signatures is left empty during the standard setup flow. This reduces signature validation to an unkeyed hash that any unauthenticated attacker can compute, enabling them to forge payment-success notifications and fraudulently mark unpaid WooCommerce orders as paid. This directly impacts e-commerce operators using affected plugin versions, their customers who may have orders fraudulently marked as fulfilled, and payment processors relying on accurate transaction records. The attack requires no authentication, no user interaction, and no special privileges, making it trivially exploitable at scale.

Casky's 283 mapped security skills leverage Claude AI's extended reasoning to correlate attack patterns across MITRE techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access), detecting anomalous payment state transitions and signature validation failures. Practitioners using Casky would observe findings flagging: (1) forged callback requests with valid-appearing but unauthenticated signatures arriving from external IP ranges, (2) order status changes to 'paid' without corresponding payment gateway logs, (3) callback processing that succeeds despite cryptographic verification failures, and (4) CWE-862 (Missing Authorization) patterns where payment modifications bypass expected business logic gates. The platform's skill coverage would specifically highlight the absence of secret key initialization and unkeyed HMAC usage—technical indicators that immediately surface as high-risk during security assessment workflows.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-11575.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-11575

Casky has 283 skills that investigate the attack patterns behind CVE-2026-11575. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn