What is the CVSS score of CVE-2026-66461?

CVE-2026-66461 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of SMEPay WooCommerce are affected by CVE-2026-66461?

SMEPay: UPI Gateway for WooCommerce plugin (versions 1.0.5 and earlier) contains an unauthenticated payment authorization bypass allowing attackers to complete orders without valid payment…

How to fix or mitigate CVE-2026-66461?

Within 24 hours, identify all WooCommerce installations running SMEPay plugin versions 1.0.5 or below and take the plugin offline immediately. Within 7 days, implement Web Application Firewall rules to block unauthenticated payment API requests and require manual payment verification for all remaining transactions, or evaluate alternative UPI payment gateways. Within 30 days, monitor vendor advisories for patch release; no vendor-released patch identified at time of analysis, so plan permanent migration away from this plugin and implement comprehensive transaction audit logging to detect any bypass attempts.

SMEPay WooCommerce CVE-2026-66461

EUVD-2026-57880 HIGH

Missing Authorization (CWE-862)

2026-08-13 Patchstack

GHSA-c6xx-q8hc-cw6x

WordPress Authentication Bypass Smepay

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Network-reachable callback endpoint requires no authentication; integrity-only impact reflects order state manipulation without data exfiltration or service disruption.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:34 vuln.today

CVE Published

Aug 13, 2026 - 13:37 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions.

AnalysisAI

Unauthenticated payment bypass in SMEPay: UPI Gateway for WooCommerce plugin (versions <= 1.0.5) allows remote attackers to complete WooCommerce orders without valid UPI payment by exploiting missing authorization controls. The plugin fails to enforce access checks on payment-related endpoints, enabling an unauthenticated network attacker to manipulate transaction state with no user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible, zero-authentication attack surface makes this trivially abusable on any exposed WooCommerce storefront running the affected plugin.

Technical ContextAI

The affected component is the SMEPay UPI Gateway for WooCommerce WordPress plugin (CPE: cpe:2.3:a:smepay:smepay:_upi_gateway_for_woocommerce:*:*:*:*:*:*:*:*). The root cause is CWE-862 (Missing Authorization), a class of flaw where server-side code executes sensitive operations - here, payment state transitions - without verifying that the requesting party is authorized to trigger them. UPI gateway plugins typically expose webhook or callback endpoints that receive payment confirmations from the payment processor; if these endpoints lack authorization checks (e.g., verifying a shared secret, HMAC signature, or session state), any unauthenticated caller can POST a crafted confirmation and force WooCommerce to mark an order as paid. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is reachable over the network with no credentials and no special setup.

RemediationAI

Update the SMEPay: UPI Gateway for WooCommerce plugin to a version beyond 1.0.5 as soon as a patched release is available from the plugin author or the WordPress plugin repository. No patched version number is independently confirmed in available data - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/smepay-for-woocommerce/vulnerability/wordpress-smepay-upi-gateway-for-woocommerce-plugin-1-0-5-payment-bypass-vulnerability and the official WordPress plugin page for release updates. If a patched version is not yet available, consider temporarily deactivating the plugin and switching to an alternative UPI payment gateway, accepting the trade-off of disrupted UPI payment processing. As a compensating control, restrict access to the plugin's callback or webhook endpoint at the web server or WAF layer to only the IP ranges used by the UPI payment processor, which limits the attack surface to spoofed or man-in-the-middle requests rather than open internet callers.