# CVE-2026-56023: Knit Pay UPI QR Code Payment Gateway for WooCommerce broken access control

Source: https://junglewise.ai/threats/cve-2026-56023-knit-pay-upi-qr-code-payment-gateway-for-woocommerce-broken  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-56023 · Severity: medium · CVSS 5.4 · Published 2026-06-25

The UPI QR Code Payment Gateway for WooCommerce, a plugin used to process mobile payments on WordPress e-commerce sites, contains a security flaw in its access control. This vulnerability allows logged-in customers to potentially perform actions they should not be authorized to do. While the impact is considered medium, it could lead to unauthorized changes in payment processing or order management.

Vendors: [Knit Pay](https://junglewise.ai/threats/vendors/knit-pay).

## Quick answers

**Is CVE-2026-56023 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56023 being exploited in the wild.

**How severe is CVE-2026-56023?** Medium severity, with a CVSS score of 5.4, published 25 June 2026.

**Which products and versions are affected?** Knit Pay UPI QR Code Payment Gateway for WooCommerce <= 1.6.2.

**Is there a fix for CVE-2026-56023?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-56023 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-56023?** Check whether you run Knit Pay UPI QR Code Payment Gateway for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A broken access control vulnerability (CWE-862: Missing Authorization) exists in the UPI QR Code Payment Gateway for WooCommerce plugin for WordPress. The flaw allows an authenticated user with 'Customer' level privileges to execute functions that lack proper authorization checks. This could result in unauthorized modifications or actions within the payment gateway component. The issue is resolved in version 1.6.3.

## Affected products

- Knit Pay UPI QR Code Payment Gateway for WooCommerce <= 1.6.2

## Timeline

- 2026-05-04: disclosed: Reported by ParkHyunWoo
- 2026-06-19: advisory: Patchstack advisory published
- 2026-06-25: other: NVD published date

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/upi-qr-code-payment-for-woocommerce/vulnerability/wordpress-upi-qr-code-payment-gateway-for-woocommerce-plugin-1-6-2-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/upi-qr-code-payment-for-woocommerce/vulnerability/wordpress-upi-qr-code-payment-gateway-for-woocommerce-plugin-1-6-2-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [Knit Pay UPI QR Code Payment Gateway for WooCommerce broken access control](https://junglewise.ai/threats/cve-2026-114191-missing-authorization-vulnerability-in-knit-pay-upi-qr-code)