CVE-2026-104118

The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders...

EUVD-2026-92072

The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders...

CVE-2026-104118 Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDOR

The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders...

CVE-2026-104118

The Razorpay for WooCommerce WordPress plugin, in versions prior to 4.8.8 , is vulnerable to an authorization bypass. The flaw exists because the plugin fails to perform ownership or authorization checks on a specific REST API route utilized during the checkout process. This oversight allows unau...

CVE-2026-104118 Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDOR

The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders...

PT-2026-104605

Name of the Vulnerable Software and Affected Versions Razorpay for WooCommerce WordPress plugin versions prior to 4.8.8 Description An issue exists where the plugin fails to perform ownership or authorization checks on a REST API route used during the checkout process. This allows unauthenticated...

CVE-2026-104118: Authorization Bypass Through User-Controlled Key

The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders...

EUVD-2026-60817

Unauthenticated Insecure Direct Object References IDOR in Razorpay for WooCommerce = 4.8.7 versions...

CVE-2026-74009

The WordPress Razorpay for WooCommerce plugin (versions ≤ 4.8.7) has an unauthenticated IDOR vulnerability allowing unauthorized access to arbitrary object references. CVSS 5.3 (MEDIUM) reflects low integrity impact. Exploitation details are not provided. Upgrade to a patched version beyond 4.8.7...

CVE-2026-74009: Authorization Bypass Through User-Controlled Key

Unauthenticated Insecure Direct Object References IDOR in Razorpay for WooCommerce = 4.8.7 versions...

WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Razorpay for WooCommerce versions = 4.8.7...

CVE-2026-39656

Missing Authorization vulnerability in Razorpay Razorpay for WooCommerce woo-razorpay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Razorpay for WooCommerce: from n/a through = 4.8.2...

CVE-2026-39656 WordPress Razorpay for WooCommerce plugin <= 4.8.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Razorpay Razorpay for WooCommerce woo-razorpay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Razorpay for WooCommerce: from n/a through = 4.8.2...

CVE-2026-39656: Missing Authorization

Missing Authorization vulnerability in Razorpay Razorpay for WooCommerce woo-razorpay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Razorpay for WooCommerce: from n/a through = 4.8.2...

CVE-2025-14294: Missing Authentication for Critical Function

The Razorpay for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the getCouponList function in all versions up to, and including, 4.7.8. This is due to the checkAuthCredentials permission callback always returning true,...

WordPress plugin Razorpay for WooCommerce 访问控制错误漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...

WordPress Razorpay for WooCommerce plugin <= 4.7.8 - Missing Authentication to Unauthenticated Order Modification vulnerability

Missing Authentication to Unauthenticated Order Modification vulnerability discovered by Marcin Dudek dudekmar - CERT.PL in WordPress Plugin Razorpay for WooCommerce versions = 4.7.8...