CVE-2026-114191

{
  "etk_id": "ETK-2026-2552",
  "cve_id": "CVE-2026-114191",
  "display_id": "CVE-2026-114191",
  "ghsa_id": "GHSA-j9wp-962q-w884",
  "euvd_id": "EUVD-2026-109298",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization bypass in Knit Pay UPI QR Code Payment Gateway",
  "summary": "Knit Pay UPI QR Code Payment Gateway for WooCommerce versions through 1.6.3 contain an authorization-control flaw. An unauthenticated remote attacker may be able to access protected information when the affected access-control path is exposed.",
  "mitigation": "Update to a vendor release later than 1.6.3 when one is confirmed to address this issue. Until then, deactivate the plugin where feasible and restrict access to the affected WordPress site and administrative functions.",
  "vendor": "Knit Pay",
  "product": "UPI QR Code Payment Gateway for WooCommerce",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.6.3"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "upi-qr-code-payment-for-woocommerce",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.009383233333333333,
  "t0_at": "2026-10-24T14:00:09.573000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-24T17:02:38.159174+00:00",
      "days": 0.12671974738425926,
      "is_lower_bound": false,
      "measured_at": "2026-10-24T14:00:09.573000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-24T14:00:09.573000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-24T14:00:09.573000+00:00",
      "url": "https://github.com/advisories/GHSA-j9wp-962q-w884"
    }
  }
}