Vulnerability feed

Executive summary

A broken access control flaw in the UPI QR Code Payment Gateway for WooCommerce WordPress plugin, made by Knit Pay, lets people without logging in reach functions they should not use. The advisory rates it 7.5 CVSS and says it is expected to be exploited, and it recommends updating the plugin to version 1.7.0 or later.

Technical summary

The flaw is classified as Broken Access Control (missing authorization, OWASP A1) in the plugin's functions. The required privilege is stated as unauthenticated, so no account is needed. Vulnerable versions are stated as 1.6.3 and earlier (<= 1.6.3), and the patched version is 1.7.0. The advisory recommends updating to 1.7.0 or later. No workaround is given beyond updating, and Patchstack notes that no mitigation rule can be assigned for this flaw. The advisory does not state detection guidance, indicators of compromise, or whether exploitation has been observed in the wild.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affects

Knit PayKnit Pay UPI QR Code Payment Gateway for WooCommerce