Technical impact
The vulnerability is a missing authorization flaw in the Knit Pay UPI QR Code Payment Gateway for WooCommerce plugin, allowing attackers to exploit incorrectly configured security levels. If successfully exploited, an attacker could gain unauthorized control over payment processing actions, potentially creating fraudulent transactions, accessing confidential payment data, or manipulating order histories. The flaw arises from insufficient checks before permitting privileged operations, meaning any user who can reach the affected endpoints may perform actions beyond their intended scope.
Affected Systems
Any WordPress site that has the Knit Pay UPI QR Code Payment Gateway for WooCommerce plugin installed at version 1.6.3 or older. The issue affects all releases from the initial version up to and including 1.6.3, regardless of the site configuration. Sites running newer versions (1.7.0 and later) are not impacted.
Risk and Exploitability
The vulnerability carries a CVSS score of 7.5, classifying it as High severity. Although EPSS data is missing, the absence of a listing in CISA’s KEV catalog suggests no confirmed exploitation cases yet, but the high severity indicates a significant risk if discovered. The likely attack vector is through web interfaces or API endpoints that lack proper authorization, making it feasible for authenticated or possibly even unauthenticated users to trigger the broken access control. Organizations should treat this as a high priority security issue until the plugin is updated.
