Is CVE-2026-56023 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56023 being exploited in the wild.

How severe is CVE-2026-56023?

Medium severity, with a CVSS score of 5.4, published 25 June 2026.

Is there a fix for CVE-2026-56023?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-56023 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-56023?

Check whether you run Knit Pay UPI QR Code Payment Gateway for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56023: Knit Pay UPI QR Code Payment Gateway for WooCommerce broken access control

CVE-2026-56023 · Severity: medium · CVSS 5.4 · Published 2026-06-25

The UPI QR Code Payment Gateway for WooCommerce, a plugin used to process mobile payments on WordPress e-commerce sites, contains a security flaw in its access control. This vulnerability allows logged-in customers to potentially perform actions they should not be authorized to do. While the impact is considered medium, it could lead to unauthorized changes in payment processing or order management.

Vendors: Knit Pay.

Quick answers

Is CVE-2026-56023 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56023 being exploited in the wild.
How severe is CVE-2026-56023?: Medium severity, with a CVSS score of 5.4, published 25 June 2026.
Which products and versions are affected?: Knit Pay UPI QR Code Payment Gateway for WooCommerce <= 1.6.2.
Is there a fix for CVE-2026-56023?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-56023 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-56023?: Check whether you run Knit Pay UPI QR Code Payment Gateway for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A broken access control vulnerability (CWE-862: Missing Authorization) exists in the UPI QR Code Payment Gateway for WooCommerce plugin for WordPress. The flaw allows an authenticated user with 'Customer' level privileges to execute functions that lack proper authorization checks. This could result in unauthorized modifications or actions within the payment gateway component. The issue is resolved in version 1.6.3.

Affected products

Knit Pay UPI QR Code Payment Gateway for WooCommerce <= 1.6.2

Timeline

2026-05-04: disclosed: Reported by ParkHyunWoo
2026-06-19: advisory: Patchstack advisory published
2026-06-25: other: NVD published date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.