Description

Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-13T14:17:07.243Z",
  "pubdate": "2026-08-13T14:17:07.243Z",
  "executiveSummary": "An unauthenticated broken access control vulnerability exists in the SMEPay: UPI Gateway for WooCommerce plugin, specifically affecting versions 1.0.5 and prior. This security flaw allows unauthenticated remote attackers to interact with vulnerable endpoints or functionalities intended to be restricted, bypassing standard authorization checks enforced by the application architecture.\nThe primary impact of this vulnerability includes unauthorized execution of administrative or sensitive actions tied to the payment gateway integration, potentially leading to unauthorized transaction handling, data leakage, or state manipulation within the WooCommerce environment.\nThe affected system is the SMEPay: UPI Gateway for WooCommerce plugin deployed on WordPress installations. The risk implication is severe, as successful exploitation requires no prior authentication or specialized privileges, lowering the attack barrier significantly.\nAttackers can leverage standard network exposure over HTTP/HTTPS to send crafted requests directly to vulnerable endpoints. The absence of proper access control validation allows malicious payloads or requests to be processed by the underlying functions without verifying the session state or identity of the requester.",
  "technicalDetails": "The root cause of this vulnerability stems from missing or inadequate capability and authorization checks within the request handling logic of the SMEPay: UPI Gateway for WooCommerce plugin in versions 1.0.5 and below. When specific endpoints or AJAX handlers are invoked, the application fails to validate whether the incoming request originates from a legitimately authenticated user with the appropriate administrative privileges.\nThe affected components are the request routing and endpoint handling functions exposed by the plugin for integration with the SMEPay payment infrastructure. These endpoints are accessible over the network via standard web requests without requiring authentication credentials or session tokens.\nThe attack flow proceeds as follows: An unauthenticated attacker identifies the exposed plugin endpoints through automated scanning or manual reconnaissance of the WordPress site structure. The attacker constructs a crafted HTTP request targeting the vulnerable functionality, omitting any authentication headers or tokens. Because the application lacks proper access control enforcement, the request is routed to the underlying function. The vulnerable component processes the supplied parameters and executes the associated logic, allowing unauthorized interaction with the payment gateway backend or plugin settings.\nPrivilege requirements are nonexistent, as the vulnerability is explicitly unauthenticated. Network exposure is external, requiring only HTTP or HTTPS connectivity to the target WordPress instance running the vulnerable plugin version. Payload behavior involves submitting parameters designed to trigger unauthorized state changes, data retrieval, or transactional logic execution.\nPost-exploitation impact depends on the specific functions exposed by the vulnerable endpoints, but generally encompasses unauthorized administrative actions, manipulation of payment processing states, exposure of sensitive transactional metadata, and potential financial fraud within the context of the WooCommerce deployment."
}