CVE-2026-84169: Unknown Upi Qr Code Payment Gateway

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment.

Affected products

• Unknown Upi Qr Code Payment Gateway: up to and including 1.4.3

Published 2026-10-05. Last modified 2026-10-06.