CVE-2026-56023 describes a broken access control vulnerability in the UPI QR Code Payment Gateway for WooCommerce by Knit Pay affecting versions up to 1.6.2. The issue is classified under CWE-862 (Missing Authorization), indicating that certain operations can be performed without proper authorization checks. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact. No patch or official remediation level has been published by the vendor as of the report date.

The vulnerability allows unauthorized users with some level of privileges to perform actions beyond their authorization, potentially leading to limited integrity and availability impacts within the affected payment gateway. There is no confidentiality impact reported. Exploitation could disrupt payment processing or modify payment-related data, but no known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No vendor-provided temporary mitigations or workarounds are currently documented.