CVE-2026-110222

Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by supplying a crafted IFSC code to IFSC.find or IFSCget. Attackers can submit network-path references or absolute URIs that URI.join resolves as a new host,...

CVE-2026-110222 Razorpay IFSC Ruby gem through 2.0.62 SSRF via IFSC lookup

Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by supplying a crafted IFSC code to IFSC.find or IFSCget. Attackers can submit network-path references or absolute URIs that URI.join resolves as a new host,...

CVE-2026-110222

The Razorpay IFSC Ruby gem versions up to and including 2.0.62 is vulnerable to a Server-Side Request Forgery (SSRF) . The flaw exists in the IFSC.find or IFSC#get methods, where a crafted IFSC code can be used to supply network-path references or absolute URIs. Because URI.join may resolve these...

CVE-2026-110222 Razorpay IFSC Ruby gem through 2.0.62 SSRF via IFSC lookup

Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by supplying a crafted IFSC code to IFSC.find or IFSCget. Attackers can submit network-path references or absolute URIs that URI.join resolves as a new host,...

EUVD-2026-99007

Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by supplying a crafted IFSC code to IFSC.find or IFSCget. Attackers can submit network-path references or absolute URIs that URI.join resolves as a new host,...

CVE-2026-110222 Razorpay IFSC Ruby gem through 2.0.62 SSRF via IFSC lookup

Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by supplying a crafted IFSC code to IFSC.find or IFSCget. Attackers can submit network-path references or absolute URIs that URI.join resolves as a new host,...

CVE-2026-110222

Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by supplying a crafted IFSC code to IFSC.find or IFSCget. Attackers can submit network-path references or absolute URIs that URI.join resolves as a new host,...

WordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Razorpay Payment Button Elementor Plugin versions = 1.2.8...

CVE-2026-110222: Server-Side Request Forgery (SSRF)

Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by supplying a crafted IFSC code to IFSC.find or IFSCget. Attackers can submit network-path references or absolute URIs that URI.join resolves as a new host,...

PT-2026-111846

Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by supplying a crafted IFSC code to IFSC.find or IFSCget. Attackers can submit network-path references or absolute URIs that URI.join resolves as a new host,...

Razorpay IFSC server-side request forgeing vulnerability

Razorpay IFSC 2.0.62 and earlier versions have a server-side request forgeing vulnerability. This vulnerability stems from server-side request forgeing, where attackers can submit specially crafted IFSC codes to IFSC.find or IFSC, along with network path references or absolute URIs. These URIs ar...

CVE-2026-104118

The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders...

CVE-2026-104118 Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDOR

The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders...

CVE-2026-104118

The Razorpay for WooCommerce WordPress plugin, in versions prior to 4.8.8 , is vulnerable to an authorization bypass. The flaw exists because the plugin fails to perform ownership or authorization checks on a specific REST API route utilized during the checkout process. This oversight allows unau...

CVE-2026-104118 Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDOR

The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders...

EUVD-2026-92072

The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders...

PT-2026-104605

Name of the Vulnerable Software and Affected Versions Razorpay for WooCommerce WordPress plugin versions prior to 4.8.8 Description An issue exists where the plugin fails to perform ownership or authorization checks on a REST API route used during the checkout process. This allows unauthenticated...

CVE-2026-104118: Authorization Bypass Through User-Controlled Key

The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders...

CVE-2026-97299

Unauthenticated Cross Site Request Forgery CSRF in Razorpay Payment Links for WooCommerce = 2.1.5 versions...

CVE-2026-97299 WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Razorpay Payment Links for WooCommerce = 2.1.5 versions...