Razorpay Razorpay for WooCommerce vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Razorpay Razorpay for WooCommerce: 3 record(s), with affected versions and fixes.

CVE-2026-74009 Medium · 5.3 CWE-639 Aug 18, 2026

WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.

CVE-2026-39656 Medium · 5.3 CWE-862 Apr 8, 2026

WordPress Razorpay for WooCommerce plugin <= 4.8.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Razorpay Razorpay for WooCommerce woo-razorpay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Razorpay for WooCommerce: from n/a through <= 4.8.2.

CVE-2025-14294 Medium · 5.3 CWE-306 Feb 19, 2026

Razorpay for WooCommerce <= 4.7.8 - Missing Authentication to Unauthenticated Order Modification

The Razorpay for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the getCouponList() function in all versions up to, and including, 4.7.8. This is due to the checkAuthCredentials() permission callback always returning true, providing no actual authentication. This makes it possible for unauthenticated attackers to modify the billing and shipping contact information (email and phone) of any WooCommerce order by knowing or guessing the order ID.