CVE-2026-56023

MediumCVSS 5.4

Published: 25/06/2026(UTC)Updated: 25/10/2026(UTC)Translated: 26/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

The UPI QR Code Payment Gateway for WooCommerce plugin version 1.6.2 and earlier contains a broken access control vulnerability. This allows unauthorized users to manipulate the payment process.

Risk Assessment

An attacker can exploit this flaw to change payment statuses or access administrator-level functions, leading to financial losses and order integrity breaches.

Recommendation

Immediately update the plugin to the latest available version. If an update is not possible, temporarily disable the plugin until a patch is released.

Other vulnerabilities in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2

CVE-2026-114191High
The UPI QR Code Payment Gateway for WooCommerce plugin (versions up to 1.6.3) has a missing authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.

Original NVD description (English source)

Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS