What is the CVSS score of CVE-2026-61954?

CVE-2026-61954 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of PayU India are affected by CVE-2026-61954?

The PayU India WordPress plugin (versions 3.8.9 and earlier) contains an unauthenticated authorization bypass allowing remote attackers to manipulate payment configurations without credentials.

How to fix or mitigate CVE-2026-61954?

Within 24 hours, audit all WordPress installations to identify systems running PayU India plugin version 3.8.9 or earlier, and immediately restrict administrative access to plugin functionality via IP allowlisting. Within 7 days, disable or fully uninstall affected plugin versions from production environments and implement enhanced logging on payment system access and configuration changes. Within 30 days, either migrate to an alternative payment processor or await a vendor-released patch, and conduct a complete audit of payment transaction logs to identify any unauthorized modifications occurring before remediation.

PayU India CVE-2026-61954

EUVD-2026-48210 HIGH

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-vhxm-3q64-wqp3

WordPress Authentication Bypass Wordpress Plugin Payu India

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network endpoint with missing authorization (PR:N/AV:N/AC:L) enabling state-changing action; impact limited to integrity, with no disclosed confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:39 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions.

AnalysisAI

Integrity compromise in the PayU India WordPress plugin (versions 3.8.9 and earlier) allows remote unauthenticated attackers to abuse functionality protected only by a missing authorization check. Reported by Patchstack, the flaw lets attackers reach privileged plugin actions without credentials, enabling manipulation of payment-related state or configuration. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

PayU India is a WordPress payment-gateway plugin that integrates the PayU merchant checkout/callback flow into WooCommerce or comparable stores, handling order state transitions and payment verification callbacks. The root cause is CWE-862 (Missing Authorization): one or more plugin endpoints or AJAX/callback handlers execute state-changing logic without verifying that the caller is authorized (no capability check, nonce, or authentication gate). The CPE cpe:2.3:a:payu_india:payu_india identifies the affected component as the PayU India plugin across all versions up to and including 3.8.9. Because the CVSS vector rates integrity as High with no confidentiality or availability impact (C:N/I:H/A:N), the exposed functionality lets an attacker alter data or state rather than read secrets or crash the site.

RemediationAI

No vendor-released patch version is identified in the available data, so confirm the fixed release directly via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/payu-india/vulnerability/wordpress-payu-india-plugin-3-8-9-broken-access-control-vulnerability) and update to the first release above 3.8.9 as soon as it is confirmed. Until a verified fix is available, apply compensating controls: place the affected plugin endpoints behind a WAF rule (Patchstack/Wordfence virtual patching) to block unauthenticated access to the vulnerable handler, restrict access to the plugin's AJAX/callback routes at the web-server layer to known PayU gateway source IPs (trade-off: may break legitimate payment callbacks if PayU's IP ranges change, so validate against current PayU documentation), and monitor logs for anomalous order-status or configuration changes. If the plugin is not actively processing live payments, disabling it removes the exposure entirely at the cost of checkout availability.