PayU India

PayU India has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 5 are fixed as of September 2026. Their average CVSS score is 7.3, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 0 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Missing Authorization, behind 2 of the records (40%). Other recurring categories include Authentication Bypass Using An Alternate Path Or Channel, Cross-Site Scripting.

Every one of the 5 issues recorded for PayU India has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, one record each. PayU India is installed on roughly 7,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSHigh

7.3/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all PayU India vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2025-31022

PayU CommercePro Plugin <= 3.8.7 - Authentication Bypass

Read the full analysis

Vulnerability Records

5 records


2026-07-22 00:00	PayU CommercePro Plugin <= 3.8.9 - Missing Authorization PayU India <= 3.8.9	`CVE-2026-61954`	5.3 Medium	Ananda Dhakal	Yes
2026-07-07 00:00	PayU CommercePro < 3.9.0 - Missing Authorization PayU India < 3.9.0	`CVE-2026-13692`	5.3 Medium	j4ck13ch4n	Yes
2025-06-05 00:00	PayU CommercePro Plugin <= 3.8.7 - Authentication Bypass PayU India <= 3.8.7	`CVE-2025-31022`	9.8 Critical	Rafie Muhammad	Yes
2025-01-06 16:09	PayU CommercePro Plugin <= 3.8.3 - Unauthenticated Privilege Escalation PayU India <= 3.8.3	`CVE-2024-12264`	9.8 Critical	wesley (wcraft)	Yes
2024-02-26 00:00	PayU India <= 3.8.8 - Reflected Cross-Site Scripting via type PayU India <= 3.8.8	`CVE-2024-27193`	6.1 Medium	Dimas Maulana	Yes

Showing 1–5 of 5 reports

Plugin Profile

Latestv3.9.0

PayU India

Author

PayU India

5.0(1)

100/100

Last Updated

2026-09-07 (6d ago)

Active Installs

7,000+

Downloads

84,207

Requires WP

5.3+

Requires PHP

7.4+

Tested up to

WP 7.0.4

Created

2021-02-10 (6y ago)

Caution: Always keep backup of your existing WooCommerce installation including Mysql Database, before installing a new module. The plugin zip can be easily installed using WordPress’s upload plugin feature.

View on WordPress.org