Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-10
Razorpay for WooCommerce - Security Vulnerability (CVE-2026-104639)
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a value derived from an incoming webhook request before using it in a SQL query, allowing users able to obtain the webhook secret (administrators) to perform SQL injection attacks.
PLUGIN
Razorpay for WooCommerce
CVE-2026-104639
Risk Score
Threat Entry
Updated 2026-11-10
Razorpay for WooCommerce - Security Vulnerability (CVE-2026-104338)
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not perform an authorization check on one of its REST routes and derives the acting user's identity from an unauthenticated request parameter, allowing an unauthenticated attacker to cause the request to execute as an arbitrary user account for the duration of the request. Exploitation additionally requires a specific coupon Razorpay for WooCommerce WordPress plugin before 4.8.9 to be active on the site.
PLUGIN
Razorpay for WooCommerce
CVE-2026-104338
Risk Score
Threat Entry
Updated 2026-11-10
Razorpay for WooCommerce - Security Vulnerability (CVE-2026-104337)
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not verify ownership of an order before returning a coupon discount computed against that order, allowing unauthenticated attackers to disclose the monetary value of arbitrary customer orders by enumerating order IDs.
PLUGIN
Razorpay for WooCommerce
CVE-2026-104337
Risk Score
Threat Entry
Updated 2026-10-06
Razorpay for WooCommerce - Security Vulnerability (CVE-2026-104118)
The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders.
PLUGIN
Razorpay for WooCommerce
CVE-2026-104118
Risk Score
Threat Entry
Updated 2026-06-17
Razorpay for WooCommerce - Broken Access Control (CVE-2025-14294)
The Razorpay for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the getCouponList() function in all versions up to, and including, 4.7.8. This is due to the checkAuthCredentials() permission callback always returning true, providing no actual authentication. This makes it possible for unauthenticated attackers to modify the billing and shipping contact information (email and phone) of any WooCommerce order by knowing or guessing the order ID.
PLUGIN
Razorpay for WooCommerce
CVE-2025-14294
Risk Score