CVE-2026-31843 is an improper access control vulnerability (CWE-284) in the goodoneuz/pay-uz Laravel package (<= 2.2.24). The vulnerability exists in the /payment/api/editable/update endpoint, which is exposed via Route::any() without authentication middleware, allowing unauthenticated remote attackers to write arbitrary PHP code into payment hook files using file_put_contents(). These files are subsequently executed via require() during normal payment workflows, resulting in remote code execution. The vendor's payment secret token is unrelated and does not protect this endpoint. The CVSS 4.0 base score is 10.0, indicating critical severity. No patch or official remediation is currently documented.

Successful exploitation allows unauthenticated remote attackers to achieve remote code execution on the affected system by overwriting executable PHP files used in payment processing. This can lead to full compromise of the application environment. The vulnerability has a CVSS 4.0 score of 10.0, reflecting its critical impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable endpoint by implementing authentication and input validation controls. Avoid exposing the /payment/api/editable/update endpoint publicly and monitor for unauthorized file modifications. Do not rely on the payment secret token as it does not mitigate this vulnerability.