WordPress security changelog
CRITICAL CVE-2025-31022 Deferred

PayU India: Privilege escalation or authentication bypass

PayU India is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.

CVE / CNA score 9.8 CVSS 3.1 · audit@patchstack.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
PayU India
Plugin slug
payu-india
Affected
See vendor advisory
Safe version
See mitigation notes
Published
Jun 09, 2025
Weakness
CWE-288 — Authentication Bypass Using an Alternate Path or Channel

This CVE was published Jun 09, 2025 and is one of 4 known issues for this plugin.

What to do

Patch or disable the affected component.

Update PayU India to a release outside the affected range, or disable and remove it until a fixed version is available.

Source record

Technical description

Authentication Bypass Using an Alternate Path or Channel vulnerability in PayU India PayU India payu-india allows Authentication Abuse.This issue affects PayU India: from n/a through < 3.8.8.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources