What is the CVSS score of CVE-2026-39656?

CVE-2026-39656 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Razorpay For Woocommerce CVE-2026-39656

EUVD-2026-20322 MEDIUM

Missing Authorization (CWE-862)

2026-04-08 Patchstack

GHSA-xj54-92rq-85wc

WordPress Authentication Bypass Razorpay For Woocommerce Wordpress Plugin Razorpay

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:42 vuln.today

CVSS changed

Apr 13, 2026 - 19:37 NVD

5.3 (MEDIUM)

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20322

CVE Published

Apr 08, 2026 - 08:30 nvd

N/A

DescriptionCVE.org

Missing Authorization vulnerability in Razorpay Razorpay for WooCommerce woo-razorpay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Razorpay for WooCommerce: from n/a through <= 4.8.2.

AnalysisAI

Razorpay for WooCommerce plugin versions 4.8.2 and earlier allow unauthenticated attackers to bypass access controls through incorrectly configured authorization checks, enabling unauthorized modification of payment-related data. This missing authorization vulnerability affects all WooCommerce sites running the affected plugin and could allow attackers to manipulate sensitive payment information without authentication. The low EPSS score (0.02%, 4th percentile) and absence of active exploitation indicators suggest limited real-world attack activity despite the accessibility of the vulnerability vector (network, no authentication required).

Technical ContextAI

The vulnerability stems from a missing authorization check (CWE-862) in the Razorpay for WooCommerce plugin, a payment gateway integration extension for WooCommerce e-commerce platforms. WooCommerce plugins operate within the WordPress plugin architecture and handle sensitive payment processing workflows. The plugin implements Razorpay payment processing by creating API endpoints and webhooks that validate transactions and payment states. The broken access control means that authorization verification is either absent or improperly implemented on one or more sensitive endpoints, allowing unauthenticated network requests to reach functions that should require authentication or capability checks. This is distinct from a simple authentication bypass-the authorization logic itself is misconfigured, suggesting conditional checks on user roles, nonces, or permissions are either missing or logically flawed.

RemediationAI

Update the Razorpay for WooCommerce plugin to the latest version released after 4.8.2 immediately. Site administrators should access their WordPress admin dashboard, navigate to Plugins > Installed Plugins, locate 'Razorpay for WooCommerce', and click the 'Update' button if available, or deactivate and remove the plugin if no patched version is available pending vendor release. Verify the updated version number post-upgrade to confirm it exceeds 4.8.2. As an interim workaround while awaiting a patch, disable the Razorpay payment gateway in WooCommerce settings if alternative payment methods are available, or restrict WooCommerce API access via Web Application Firewall rules targeting the plugin's endpoints. Monitor the Patchstack database and official Razorpay release notes for patched version availability. Reference security advisory at https://patchstack.com/database/Wordpress/Plugin/woo-razorpay/.