CVE-2026-114191

HighCVSS 7.5

Published: 24/10/2026(UTC)Updated: 26/10/2026(UTC)Translated: 24/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

The UPI QR Code Payment Gateway for WooCommerce plugin (versions up to 1.6.3) has a missing authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.

Risk Assessment

An unauthorized party may gain access to functions or data that should be protected. This could result in unauthorized payment operations or information disclosure.

Recommendation

Update the UPI QR Code Payment Gateway for WooCommerce plugin to a version later than 1.6.3. Review and correct access control configuration on the site.

Other vulnerabilities in UPI QR Code Payment Gateway for WooCommerce

CVE-2026-56023Medium
The UPI QR Code Payment Gateway for WooCommerce plugin version 1.6.2 and earlier contains a broken access control vulnerability. This allows unauthorized users to manipulate the payment process.

Original NVD description (English source)

Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS