Knit Pay UPI CVE-2026-114191

The target must be a WordPress site running WooCommerce with the UPI QR Code Payment Gateway for WooCommerce plugin at a version from n/a through 1.6.3 installed; the description attributes the flaw to incorrectly configured access control security levels on a plugin endpoint. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are required, so exploitation works remotely against affected installations without special privileges. The practical limiting factor is deployment footprint rather than configuration: this is a niche UPI (India-oriented) payment plugin, so exposure is confined to the specific stores that have it installed and active. Impact is limited to confidentiality (C:H); integrity and availability are not affected (I:N/A:N).

This is a missing-authorization flaw (CWE-862) in the UPI QR Code Payment Gateway for WooCommerce WordPress plugin, scored CVSS 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - network-reachable, low-complexity, and unauthenticated (PR:N). Impact is confidentiality-only (C:H; I:N/A:N), so this is a broken-access-control information-disclosure issue rather than a code-execution or tampering bug, which moderates its practical severity despite the HIGH rating. The vuln.today priority is 'this_week', a near-term but not emergency signal. No EPSS score, no CISA KEV listing, and no confirmed proof-of-concept were supplied; the single reference is a Patchstack advisory entry, not working exploit code, so there is no public exploit identified at time of analysis. The signals are internally consistent - an unauthenticated network C:H bug on a WordPress plugin typically attracts opportunistic scanning - but the absence of EPSS/KEV/POC data means exploitation likelihood cannot be quantified from the input. EPSS and KEV are simply missing rather than conflicting, so their absence should not be read as low risk; treat this as a real but not emergency patching priority consistent with the 'this_week' label.

A remote attacker sends a crafted request directly to an access-control-deficient endpoint of the plugin on a WooCommerce store, without authenticating (PR:N) and without any user interaction (UI:N). Because low attack complexity applies (AC:L), the request succeeds against an affected installation and returns data that should have been restricted, disclosing confidential information (C:H). No confirmed proof-of-concept or working exploit code was provided in the input.