{"id":"CVE-2026-114191","kind":"vulnerability","aliases":["CVE-2026-114191"],"related":[],"title":"Knit Pay UPI QR WooCommerce plugin: missing authorization check through 1.6.3","description":"Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3.","summary":"The Knit Pay UPI QR Code Payment Gateway plugin for WooCommerce has a missing authorization check, so requests can reach functions that should be restricted. The sources do not say which function or what data or actions an attacker gains.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin plugin list or `wp plugin get upi-qr-code-payment-for-woocommerce --field=version`\n- Confirm whether the plugin is active on the store","fix":"- Update the UPI QR Code Payment Gateway for WooCommerce plugin to a version later than `1.6.3` once the vendor publishes one (the sources do not name a fixed version)\n- If no fixed version exists, deactivate the plugin until it is patched","status":"open","published_at":"2026-10-24T14:16:38+00:00","first_seen_at":"2026-10-24T14:48:21+00:00","triaged_at":"2026-10-25T03:14:45+00:00","updated_at":"2026-10-25T03:14:45+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-25T03:14:45Z","model":"claude-haiku-5-5","output":{"fix":"- Update the UPI QR Code Payment Gateway for WooCommerce plugin to a version later than `1.6.3` once the vendor publishes one (the sources do not name a fixed version)\n- If no fixed version exists, deactivate the plugin until it is patched","reach":"internet","title":"Knit Pay UPI QR WooCommerce plugin: missing authorization check through 1.6.3","impact":"medium","summary":"The Knit Pay UPI QR Code Payment Gateway plugin for WooCommerce has a missing authorization check, so requests can reach functions that should be restricted. The sources do not say which function or what data or actions an attacker gains.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","php"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown access to plugin functions; exact impact not stated","analyst_note":"Find the vendor advisory or the Wordfence/NVD entry to learn the affected function, required privilege, and the fixed version.","how_to_check":"- Check the installed plugin version in the WordPress admin plugin list or `wp plugin get upi-qr-code-payment-for-woocommerce --field=version`\n- Confirm whether the plugin is active on the store","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Knit Pay UPI QR Code Payment Gateway for WooCommerce plugin at version 1.6.3 or earlier. The sources do not say which store configurations expose the flaw. Stores that do not have this plugin installed can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000633,"input_tokens":3343,"output_tokens":598,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114191':14A,17A '-2026':13A,16A '1.6.3':11A,102C 'access':86C 'action':58B 'affect':91C 'allow':82C 'attack':60B 'author':8A,36B,63C 'check':9A,37B 'code':27B,70C,78C,94C 'configur':85C 'control':87C 'cve':12A,15A 'data':56B 'exploit':83C 'function':42B,53B 'gain':61B 'gateway':29B,72C,96C 'incorrect':84C 'issu':90C 'knit':1A,23B,66C 'levels.this':89C 'miss':7A,35B,62C 'n/a':100C 'packag':18B 'pay':2A,24B,67C 'payment':28B,71C,79C,95C 'php':19B 'plugin':6A,30B 'qr':4A,26B,69C,77C,93C 'reach':41B 'request':39B 'restrict':46B 'say':51B 'secur':88C 'sourc':48B 'upi':3A,25B,68C,76C,92C 'upi-qr-code-payment-for-woocommerc':75C 'vulner':64C 'woocommerc':5A,20B,32B,74C,81C,98C 'wordpress':21B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Knit Pay UPI QR Code Payment Gateway for WooCommerce plugin at version 1.6.3 or earlier. The sources do not say which store configurations expose the flaw. Stores that do not have this plugin installed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T14:16:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114191","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114191","severity":null,"published_at":"2026-10-24T14:16:38+00:00","modified_at":"2026-10-24T14:16:38+00:00","first_seen_at":"2026-10-24T14:48:21+00:00","fetched_at":"2026-10-24T14:48:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}