The vulnerability is an unauthenticated broken access control flaw in the SMEPay: UPI Gateway for WooCommerce plugin, affecting all releases up to and including version 1.0.5. Exploitation of this flaw would allow an attacker to illicitly change or accept payments, effectively bypassing the payment gateway’s security checks and compromising transaction integrity. The flaw permits manipulation of payment flows without authentication, potentially allowing a malicious user to authorize payments or alter transaction amounts.

The affected product is the WordPress plugin SMEPay: UPI Gateway for WooCommerce, currently released as version 1.0.5 and earlier. All WordPress sites using this plugin at any version <=1.0.5 are vulnerable. No other components are reported to be impacted.

The CVSS score of 7.5 classifies the vulnerability as high severity. The exploitation probability is not quantified via EPSS, but the lack of authentication requirement implies that any web user could abuse the exposed endpoints, making the attack likely if the plugin is enabled on a publicly accessible site. The vulnerability is not listed in CISA’s KEV catalog; nevertheless, the potential for financial loss via payment manipulation warrants immediate action. Attackers can achieve unauthorized transaction acceptance or alteration, compromising the confidentiality, integrity, and availability of the e-commerce system.