5.3
Medium
CVE-2026-84169 The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request…
Description
The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| UPI QR Code Payment Gateway 1.4 | earliest → 1.4.3 | No fix stated |