The vulnerability is a broken access control flaw within the WordPress UPI QR Code Payment Gateway for WooCommerce plugin. It allows an attacker to bypass authentication or authorization checks when interacting with the plugin’s payment processing functions. As a result, an attacker could manipulate order data, trigger unauthorized payment requests, or retrieve sensitive transaction information, thereby compromising confidentiality, integrity, or availability of the e‑commerce system.

The affected product is the Knit Pay UPI QR Code Payment Gateway for WooCommerce plugin for WordPress. Versions up to and including 1.6.2 are impacted. Later releases, starting with 1.6.3, contain the fix.

The CVSS score of 5.4 indicates a medium severity vulnerability. EPSS data is not available, so the likelihood of exploitation cannot be quantified from these metrics; however, the flaw exists in a widely used WordPress plugin, suggesting a potential for exploitation. It is not listed in CISA KEV. The likely attack path is through the plugin’s API or administrative interfaces exposed by the WordPress installation, where an authenticated or possibly unauthenticated user could alter request parameters to access protected resources.