CVE-2026-84169 — UPI QR Code Payment Gateway <= 1.4.3 - Unauthenticated Cross-Order Payment-Status Forgery

CVE-2026-84169

UPI QR Code Payment Gateway <= 1.4.3 - Unauthenticated Cross-Order Payment-Status Forgery PUBLISHED

Description (CNA)

The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment.

Affected (CNA)

Vendor / product	Versions
Unknown / UPI QR Code Payment Gateway	affected 0 through 1.4.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/94a90832-4cf9-4664-9086-5705429f759c/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.