CVE-2026-84169

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-05

Last updated on: 2026-10-06

Assigner: WPScan

Description

The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-05

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-05

EPSS Evaluated

2026-10-18

NVD

CVE-2026-84169

EUVD

EUVD-2026-92260

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	UPI	QR Code Payment Gateway 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an unauthenticated cross-order payment-status forgery in the UPI QR Code Payment Gateway WordPress plugin up to version 1.4.3. The plugin fails to verify that a payment-confirmation request matches the correct order and customer, allowing attackers to mark any order as paid without making an actual payment.

Detection Guidance

To detect this vulnerability, check if your WordPress site uses the UPI QR Code Payment Gateway plugin version 1.4.3 or lower. Inspect network traffic for unauthenticated payment-confirmation requests that modify order status without valid payments. Look for suspicious POST requests to payment confirmation endpoints.

Impact Analysis

Attackers could exploit this to trick the system into marking orders as paid without receiving payment, leading to financial losses for merchants. Customers might receive products or services without valid payment, causing disputes and chargebacks.

Compliance Impact

This vulnerability could lead to unauthorized transactions being marked as paid, potentially violating data integrity and financial compliance requirements in standards like GDPR (for payment data handling) and HIPAA (if payment data relates to healthcare transactions). Unauthorized order confirmations may also breach audit trails required by these regulations.

Mitigation Strategies

Immediately update the UPI QR Code Payment Gateway WordPress plugin to the latest version beyond 1.4.3 to patch the vulnerability. If an update is not available, consider disabling or removing the plugin until a fix is released.

Hi! I’m here to help you understand CVE-2026-84169. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70