CVE-2026-84169 MEDIUM 5.3
Published: 2026-10-05 06:16:59 UTC · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Categories: Web servers & CMS
The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment.
Weakness: CWE-639