116 matches found
CVE-2026-104118
The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders...
CVE-2026-104118 Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDOR
The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders...
EUVD-2026-92072
The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders...
CVE-2026-104118
The Razorpay for WooCommerce WordPress plugin, in versions prior to 4.8.8 , is vulnerable to an authorization bypass. The flaw exists because the plugin fails to perform ownership or authorization checks on a specific REST API route utilized during the checkout process. This oversight allows unau...
PT-2026-104605
The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders...
CVE-2026-104118: Undefined Security Weakness
The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders...
CVE-2026-97299
Unauthenticated Cross Site Request Forgery CSRF in Razorpay Payment Links for WooCommerce = 2.1.5 versions...
CVE-2026-97299 WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Razorpay Payment Links for WooCommerce = 2.1.5 versions...
CVE-2026-97299 WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Razorpay Payment Links for WooCommerce = 2.1.5 versions...
CVE-2026-97299
The Razorpay Payment Links for WooCommerce WordPress plugin, versions
EUVD-2026-89934
Unauthenticated Cross Site Request Forgery CSRF in Razorpay Payment Links for WooCommerce = 2.1.5 versions...
WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Oly Hossen in WordPress Plugin Razorpay Payment Links for WooCommerce versions = 2.1.5...
CVE-2026-97299: Cross-Site Request Forgery (CSRF)
Unauthenticated Cross Site Request Forgery CSRF in Razorpay Payment Links for WooCommerce = 2.1.5 versions...
CVE-2026-89426
The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the maybeupdateuserrole function reading the target role directly from an attacker-controlled Gravity Forms entry...
EUVD-2026-86579
The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the maybeupdateuserrole function reading the target role directly from an attacker-controlled Gravity Forms entry...
CVE-2026-89426
The Knit Pay WordPress plugin (versions up to and including 9.6.1.0 ) is vulnerable to Privilege Escalation . The root cause is the maybe_update_user_role() function, which reads a target role directly from an attacker-controlled Gravity Forms entry field (via user_role_field_id) and passes it to...
CVE-2026-89426 Knit Pay <= 9.6.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms Role Field
The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the maybeupdateuserrole function reading the target role directly from an attacker-controlled Gravity Forms entry...
CVE-2026-94179
Unauthenticated Cross Site Scripting XSS in Razorpay Payment Button = 2.4.9 versions...