CVE-2026-84169

MediumCVSS 5.3/10Last modified Oct 6, 2026

Description

The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
Unknown	UPI QR Code Payment Gateway	<= 1.4.3

References

https://wpscan.com/vulnerability/94a90832-4cf9-4664-9086-5705429f759c/

Timeline

Published: Oct 5, 2026
Last modified: Oct 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-84178.8Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/<pkgHandle>. Th CVE-2026-841708.3Allocation of resources without limits or throttling in Apache Wicket. org.apache.wicket.markup.html.form.upload.resource.AbstractFileUploa CVE-2026-841719.8The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a p CVE-2026-841726.3Files accessible to external parties in Apache Wicket. org.apache.wicket.markup.html.PackageResourceGuard decides whether a file on the cla CVE-2026-841738.3In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rul CVE-2026-841755.3In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API use CVE-2026-841766.5Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apach CVE-2026-841776.3Incorrect behavior order in Apache Wicket: a file path is validated before the framework appends the attributes that complete it. org.apach CVE-2026-841786.1Cross-Site Request Forgery (CSRF) vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18 CVE-2026-841796.5Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result with CVE-2026-84184.3The Games Catalog plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.0. This is due to m CVE-2026-841805.3Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Knative component. This issue affects Apache Cam