Authentication Bypass in UPI QR Code Payment Gateway Plugin for WordPress
CVE-2026-84169
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 5 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-84169?
The UPI QR Code Payment Gateway Plugin for WordPress, up to version 1.4.3, is susceptible to an authentication bypass vulnerability. This flaw allows unauthenticated attackers to manipulate payment-confirmation requests, enabling them to falsely mark any order as paid without completing the payment process. This can lead to unauthorized fund transfers and financial loss for businesses that rely on the plugin for processing transactions.
Affected Version(s)
UPI QR Code Payment Gateway 0 <= 1.4.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.