UPI QR Gateway CVE-2026-84169

Exploitation requires that the target WordPress site runs the UPI QR Code Payment Gateway plugin (version 1.4.3 or earlier) as an active checkout payment method, and that the attacker can place or reference a valid order to obtain/guess its order identifier. The core condition is the plugin's payment-confirmation endpoint, which does not bind the confirmation to the specific order and customer, so a crafted unauthenticated request can confirm any order. Limiting factors: impact is confined to falsifying payment status (integrity only - no data exposure or outage), the plugin must actually be installed and enabled, and realistic fraud depends on the attacker knowing or enumerating valid order IDs; there is no user interaction or authentication barrier per the CVSS vector.

This is a genuine but moderate-priority issue rather than a critical one, and the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction, which is why the score reaches 5.3 despite only a limited integrity impact (C:N/I:L/A:N) - there is no data disclosure or denial of service, only the ability to falsify an order's payment status. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or automated exploit availability; exploitation status is therefore 'no public exploit identified at time of analysis.' The absence of KEV/EPSS is expected for a freshly disclosed WordPress plugin flaw reported by WPScan and should not be read as low risk - the real-world impact is financial fraud (goods/services released without payment) on e-commerce sites using this gateway, which can be meaningful for affected merchants even though the technical CVSS impact is only 'Low' integrity. SSVC framing: exploitation is 'none' observed, the flaw is likely 'automatable' (a simple forged confirmation request), but technical impact is 'partial.' Net: a real issue worth patching promptly for anyone running this plugin, but not a mass-exploitation emergency given the niche footprint and limited technical impact.

An attacker places an order on a WordPress store using the UPI QR Code Payment Gateway and, instead of paying, sends a forged payment-confirmation request referencing that order ID. Because the plugin never validates that the confirmation belongs to the order/customer, the order is marked 'paid' and fulfillment proceeds without any money changing hands. No authentication or user interaction is required (AV:N/PR:N/UI:N), and no public exploit code was provided in the input.