CVE-2026-104338

The Razorpay for WooCommerce WordPress plugin, in versions before 4.8.9 , is vulnerable to an unauthenticated user context switch . The root cause is a missing authorization check on a REST route where the plugin derives the acting user's identity from an unauthenticated request parameter . An un...

CVE-2026-104338 Razorpay for WooCommerce < 4.8.9 - Unauthenticated User Context Switch via 1cc Coupon Route

The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not perform an authorization check on one of its REST routes and derives the acting user's identity from an unauthenticated request parameter, allowing an unauthenticated attacker to cause the request to execute as an arbitrary user...

WordPress Razorpay for WooCommerce plugin < 4.8.9 - Unauthenticated User Context Switch vulnerability

Unauthenticated User Context Switch vulnerability discovered by RIA Labs in WordPress Plugin Razorpay for WooCommerce versions 4.8.9...