Vulnerability · Published Oct 5, 2026 · Assigned by WPScan
CVE-2026-84169UPI QR Code Payment Gateway <= 1.4.3 - Unauthenticated Cross-Order Payment-Status Forgery
Medium 5.3
In plain English
A medium-severity authorization bypass via user-controlled key in UPI QR Code Payment Gateway from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 92.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | UPI QR Code Payment Gateway | 0 – through 1.4.3 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/94a90832-4cf9-4664-9086-5705429f759c/ exploit, vdb-entry, technical-description