WordPress Plugin Vulnerabilities

UPI QR Code Payment Gateway <= 1.4.3 - Unauthenticated Cross-Order Payment-Status Forgery

Description

The plugin does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment.

Proof of Concept

Affects Plugins

Plugin icon
upi-qr-code-payment-gateway
No known fix

References

CVE
CVE-2026-84169

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Pedro Pinho
Submitter
Pedro Pinho
Verified
Yes
WPVDB ID
94a90832-4cf9-4664-9086-5705429f759c

Timeline

Publicly Published
2026-10-02 (about 2 days ago)
Added
2026-09-25 (about 9 days ago)
Last Updated
2026-09-25 (about 9 days ago)

Other

Published
Title
Published
2025-03-31
Title
Radius Blocks <= 2.2.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-05-13
Title
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses < 4.3.6 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter
Published
2026-03-12
Title
GetGenie < 4.3.3 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Post Overwrite/Deletion
Published
2024-03-29
Title
Thumbs Rating <= 5.1.0 - Unauthenticated Insecure Direct Object Reference
Published
2023-09-12
Title
wpDiscuz < 7.6.4 - Unauthenticated Data Modification via IDOR