What is the CVSS score of EUVD-2026-39378?

EUVD-2026-39378 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

UPI QR Code Payment Gateway EUVD-2026-39378

| CVE-2026-56023 MEDIUM

Missing Authorization (CWE-862)

2026-06-25 Patchstack

GHSA-qc9g-q3w6-g945

WordPress Authentication Bypass Wordpress Plugin Knit Pay Upi Qr Code Payment Gateway For Woocommerce

5.4

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

PR:L confirmed by authenticated-only exploitation; C:L added as BAC in payment context likely exposes order data; A:N as disruption is limited, not denial of service.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:37 vuln.today

CVE Published

Jun 25, 2026 - 13:12 cve.org

MEDIUM 5.4

DescriptionCVE.org

Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions.

AnalysisAI

Broken Access Control in the UPI QR Code Payment Gateway for WooCommerce plugin (versions <= 1.6.2) allows authenticated low-privilege WordPress users to perform actions or access endpoints reserved for higher-privileged roles, resulting in unauthorized modification of payment data or disruption of payment processing. The flaw, rooted in missing authorization checks (CWE-862), was disclosed by Patchstack and affects sites running WooCommerce with this Knit Pay plugin installed. No public exploit code has been identified at time of analysis, and it has not been confirmed as actively exploited.

Technical ContextAI

The affected component is the Knit Pay 'UPI QR Code Payment Gateway for WooCommerce' WordPress plugin (CPE: cpe:2.3:a:knit_pay:upi_qr_code_payment_gateway_for_woocommerce:*:*:*:*:*:*:*:*), which provides UPI QR code-based payment processing as a WooCommerce payment method - primarily targeting merchants operating in South Asian markets. CWE-862 (Missing Authorization) indicates the plugin exposes one or more AJAX handlers, REST API endpoints, or admin-facing actions without verifying that the requesting user actually holds the required capability or role. In WordPress/WooCommerce, this class of flaw typically manifests when nonce validation is present (authentication check) but capability checks such as current_user_can() are absent, allowing any authenticated subscriber or customer to trigger privileged operations.

RemediationAI

Upstream fix availability has not been independently confirmed from the available data - the exact patched version is not specified in the Patchstack advisory or NVD CPE records at time of analysis. Site administrators should immediately check the WordPress Plugin Directory or the Knit Pay vendor site for a release newer than 1.6.2 and upgrade if available. As a compensating control while awaiting a patch, administrators should disable the plugin if UPI QR payments are not operationally required, as this eliminates the attack surface entirely. If the plugin must remain active, restrict WooCommerce account registration to trusted users only (Settings > Accounts > Account creation), which reduces the pool of potential low-privilege attackers. Monitoring WordPress audit logs for unexpected AJAX or REST requests targeting the plugin's endpoints can provide detection coverage. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/upi-qr-code-payment-for-woocommerce/vulnerability/wordpress-upi-qr-code-payment-gateway-for-woocommerce-plugin-1-6-2-broken-access-control-vulnerability should be monitored for patch confirmation.