CVE-2026-114191: WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
UPI QR Code Payment Gateway for WooCommerceto a version that resolves this vulnerability.Fixed in 1.7.0
Event History
Frequently Asked Questions
Which installations are affected?
UPI QR Code Payment Gateway for WooCommerce versions through 1.6.3 are affected. The available data does not identify a fixed version.
Can this be exploited remotely without an account or user interaction?
Yes. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the likely security impact?
The issue is rated high severity with a CVSS score of 7.5. The vector indicates high confidentiality impact, with no stated integrity or availability impact.
What should teams do if they cannot patch immediately?
The provided data does not document a workaround or mitigating configuration. Because exploitation requires no privileges, administrators should treat exposed affected installations as requiring prompt remediation.