CVE-2023-6064 is a high severity (CVSS 7.5 in the record) information exposure in the PayHere Payment Gateway WordPress plugin before 2.2.12. The plugin writes publicly accessible log files with sensitive information whenever transactions occur. Update to 2.2.12 or later and remove the old logs. WPScan scores it 5.3 Medium.
What's affected
- Plugin: PayHere Payment Gateway for WordPress.
- Affected: versions before 2.2.12.
- Fixed: 2.2.12, per the NVD record and WPScan.
- Severity: 7.5 High in the NVD record. WPScan scores it 5.3 Medium. The scores differ because the logs hold transaction details rather than card numbers.
- Leak: log files created in a folder under the uploads directory, readable by anyone who can request them.
How to check if you're exposed
In the WordPress admin, open Plugins and read the version shown under PayHere Payment Gateway. With shell access and WP-CLI, this lists every installed plugin with its version, status and whether an update is waiting:
wp plugin list --fields=name,title,version,status,update
Find the row for PayHere Payment Gateway and compare its version with the fixed version above. On a multisite network, run the same command on each site, because a plugin can be active on some sites and not others. The folder is payhere-payment-gateway.
A version below 2.2.12 is affected. Then check for existing logs. Look in your uploads folder for a payhere logs directory, and check whether its files are served to a normal browser session while logged out. Do this only on your own site:
ls wp-content/uploads | grep -i payhere
What to do now
- Update PayHere Payment Gateway to 2.2.12 or later.
- Delete old log files from the plugin's log folder under uploads, after saving a copy offline if you need them for records.
- Block public access to the log folder at the web server level, so future files cannot be fetched.
- Review what the logs contained, such as order details and customer data, and decide whether notification duties apply under privacy rules in your region.
- Check other payment or logging plugins for the same habit of writing logs into uploads.
Why it matters
The plugin writes transaction logs into a folder that the web server serves to the public, with no access check. WPScan classes the problem as sensitive data disclosure, and the record lists CWE-532, insertion of sensitive information into a log file. Two mistakes combine here: sensitive data goes into the log, and the log sits where anyone can read it.
Logs are easy to forget. They grow quietly, nobody reviews them, and they can hold personal details and payment related identifiers for years. The fix in the plugin stops the exposure going forward, but old files on disk remain until you delete them. The record does not list this CVE as known exploited. Moving logs outside the web root, or denying access to the folder, is the lasting pattern.
Quick check
Does updating remove the old logs?
Not necessarily. Check the log folder yourself, and delete files created by earlier versions after saving what you need.
Sources
Last reviewed: 19 October 2026.
