What is the CVSS score of CVE-2026-57424?

CVE-2026-57424 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

rzp-woocommerce CVE-2026-57424

Q: Which versions of rzp-woocommerce are affected by CVE-2026-57424?

Missing authorization in Razorpay Payment Links for WooCommerce (versions through 2.1.4) allows unauthenticated network attackers to invoke privileged plugin actions without any authentication check.

EUVD-2026-43351 MEDIUM

Missing Authorization (CWE-862)

2026-07-13 Patchstack

WordPress Authentication Bypass Wordpress Plugin Razorpay Payment Links For Woocommerce

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-accessible, unauthenticated missing authorization with no confidentiality loss; limited integrity and availability impact on payment link data only.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:22 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

MEDIUM 6.5

DescriptionCVE.org

Missing Authorization vulnerability in knitpay Razorpay Payment Links for WooCommerce rzp-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Razorpay Payment Links for WooCommerce: from n/a through <= 2.1.4.

AnalysisAI

Missing authorization in Razorpay Payment Links for WooCommerce (versions through 2.1.4) allows unauthenticated network attackers to invoke privileged plugin actions without any authentication check. The flaw stems from CWE-862, where one or more AJAX endpoints or REST routes in the plugin fail to verify the caller's identity or capability before executing sensitive operations, resulting in low-severity integrity and availability impacts against WooCommerce payment link workflows. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.

Technical ContextAI

The affected component is the 'Razorpay Payment Links for WooCommerce' WordPress plugin (slug: rzp-woocommerce, vendor: knitpay), identified by CPE cpe:2.3:a:knitpay:razorpay_payment_links_for_woocommerce:*:*:*:*:*:*:*:*. This plugin integrates the Razorpay Indian payment gateway with WooCommerce to generate and manage hosted payment links. CWE-862 (Missing Authorization) indicates the plugin registers one or more WordPress hooks - likely wp_ajax_nopriv_ actions or unauthenticated REST API routes - that perform state-changing operations (creating, modifying, or invalidating payment links/orders) without calling current_user_can() or equivalent capability checks. This is a common pattern in WordPress plugin vulnerabilities where developers expose AJAX handlers to all visitors by registering them under the nopriv hook, forgetting to enforce access control within the callback.

RemediationAI

Check the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/rzp-woocommerce/vulnerability/wordpress-razorpay-payment-links-for-woocommerce-plugin-2-1-4-broken-access-control-vulnerability for a patched release above version 2.1.4; upgrade immediately if one is available. No exact fixed version was confirmed in the available intelligence, so verify directly against the WordPress.org plugin changelog or the knitpay vendor repository before upgrading. As a compensating control while awaiting a patch, disable the plugin entirely if Razorpay payment link generation is not actively required, which eliminates the attack surface with no side effects beyond loss of that payment method. Alternatively, use a Web Application Firewall (WAF) rule to block unauthenticated POST requests to wp-admin/admin-ajax.php targeting the specific action parameter associated with this plugin's vulnerable handler - however, the precise action name is not confirmed in available data, making this mitigation harder to implement precisely without source code review.