CVE-2026-104338
Razorpay for WooCommerce < 4.8.9 - Unauthenticated User Context Switch via 1cc Coupon Route
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not perform an authorization check on one of its REST routes and derives the acting user's identity from an unauthenticated request parameter, allowing an unauthenticated attacker to cause the request to execute as an arbitrary user account for the duration of the request. Exploitation additionally requires a specific coupon Razorpay for WooCommerce WordPress plugin before 4.8.9 to be active on the site.
| Vendor | unknown |
| Product | razorpay for woocommerce |
| Published | Nov 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown razorpay for woocommerce
Be the first to know when new unknown vulnerabilities affecting unknown razorpay for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Razorpay for WooCommerce
0 < 4.8.9
References
Credits
RIA Labs WPScan