The UPI QR Code Payment Gateway WordPress plugin version 1.4.3 and earlier fails to validate that a payment‑confirmation request is associated with the order and customer it purports to confirm. This omission allows an attacker who can send a crafted HTTP request to the confirmation endpoint to mark any order as paid without completing a legitimate transaction. The flaw represents an authorization bypass and can lead to fraudulent order fulfillment, potentially causing merchant revenue loss and trust damage.

WordPress sites that have installed the UPI QR Code Payment Gateway plugin 1.4.3 or earlier are vulnerable; no other vendors or product versions are cited.

The vulnerability lacks authentication or authorization checks on the confirmation endpoint, so the attack can be performed over the public Internet by submitting an unauthenticated request. With a CVSS score of 5.3 the issue is rated medium severity, and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog, so there is no confirmed exploitation evidence. Nonetheless, the ability to forge payment status grants an attacker the potential to trigger automatic fulfillment processes, making the risk significant for affected merchants.