UPI QR Code Payment Gateway

UPI QR Code Payment Gateway has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it remains unpatched as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.

The most common weakness is Authorization Bypass Through User-Controlled Key, behind 1 of the records (100%).

The one issue recorded for UPI QR Code Payment Gateway has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2026.

All of these findings were reported by Pedro Pinho. UPI QR Code Payment Gateway is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
5.3/ 10
Patch Coverage0%
Open

1

Fixed

0

Get automatic notifications for all UPI QR Code Payment Gateway vulnerabilities before they are exploited.

Most severe open issueCVSS 5.3CVE-2026-84169

UPI QR Code Payment Gateway <= 1.4.3 - Unauthenticated Insecure Direct Object Reference

Read the full analysis

Vulnerability Records

1 records
UPI QR Code Payment Gateway banner
Latestv1.5.2

UPI QR Code Payment Gateway

Dew Technolab

Author

Dew Technolab

5.0(6)
100/100
Last Updated
2026-10-14 (5d ago)
Active Installs
1,000+
Downloads
34,105
Requires WP
4.6+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2021-03-17 (6y ago)
Requires Plugins
woocommerce

Accept UPI payments on your WooCommerce store with a UPI QR code. Customers scan it with Google Pay, PhonePe, Paytm, BHIM, WhatsApp Pay or any banking UPI app, and the money goes straight into your bank account, with no payment gateway fees. UPI (Unified Payments Interface) is India’s instant payment system, run by the National Payments Corporation of India (NPCI). It works 24&#215;7. Features UPI QR code with the exact order amount and order number, on desktop and mobile, with an optional “Download QR Code” button on mobile. Customers enter the 12-digit UPI Transaction ID (UTR) and can upload a payment screenshot. Works with the classic checkout and the WooCommerce Checkout block. Orders wait On Hold until you confirm the payment in your bank or UPI app. The same UTR can’t be used for two orders, and the UTR and payer UPI ID appear in the Orders list. Payment screenshots are stored privately, not in the Media Library, and only shop managers can open them. Unpaid UPI orders get extra time before WooCommerce cancels them (24 hours by default), so customers who pay and come back later aren’t lost. Optional email with a payment link for customers who haven’t paid yet. Light and dark popup themes, and customizable checkout and popup texts. Compatible with HPOS, translation-ready, and included in WordPress’s personal data export and erase tools. Why choose this plugin? Built for safety: submitted payments are clearly marked “Submitted, verify payment”, and you are warned if a setting would complete orders before anyone checks the payment. Private: payment screenshots show customers’ bank details, so they are never public files. No lost orders: a customer who paid but took a while to enter the Transaction ID can still finish, and is told what to do if their order was cancelled. How it works At checkout, the customer chooses UPI and sees a QR code for the order amount. They scan it with any UPI app and pay. They enter the 12-digit Transaction ID (UTR) shown in their UPI app and, if you ask for it, upload a screenshot. The order goes On Hold, and you get the payment notification in your UPI app. You check the payment in your bank or UPI app and mark the order Processing or Completed. UPI payments made by scanning a QR code can’t be verified automatically, so always check each payment before completing the order. Benefits No payment gateway fees or commission. Money goes directly into your bank account. Simple setup: you only need your merchant UPI ID. Send customers a payment link by email. Works 24&#215;7. Support Community support in the support forum at WordPress.org. Like the plugin? Please consider leaving a review.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C