diff --git a/server/src/routes/wxmsg.js b/server/src/routes/wxmsg.js
index 9cbadcf..d862e84 100644
--- a/server/src/routes/wxmsg.js
+++ b/server/src/routes/wxmsg.js
@@ -38,6 +38,11 @@ module.exports = function registerWxMsgRoutes(app) {
 
   app.post('/api/wx/msg', async (req, res) => {
     try {
+      // 验签：明文模式下 POST 同样携带 signature/timestamp/nonce，防止伪造支付回调
+      const { signature, timestamp, nonce } = req.query || {}
+      if (!verifySignature(timestamp, nonce, signature)) {
+        return res.status(403).send('forbidden')
+      }
       // 数据格式推荐 JSON：express.json 已解析为对象；选 XML 时是字符串
       let fields = {}
       if (req.body && typeof req.body === 'object') {