EUVD-2026-60817
GHSA-vqvx-w44w-grjh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
IDOR inherently exposes referenced objects' data, warranting C:L over the vendor's C:N; all other metrics align with unauthenticated remote exploitation at low complexity.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.
AnalysisAI
Unauthenticated IDOR in the Razorpay for WooCommerce WordPress plugin (versions ≤ 4.8.7) allows remote attackers to manipulate order object references without any authentication, potentially bypassing payment authorization checks or modifying order state. Reported by Patchstack and corroborated by ENISA EUVD-2026-60817, this affects all WooCommerce stores running the vulnerable plugin versions with the Razorpay payment gateway active. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - the CVSS vector (PR:N) and the 'Unauthenticated' qualifier in the description confirm this is exploitable by any remote party with HTTP access to the WordPress site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 5.3 (Medium) is supported by a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating fully remote, low-complexity, unauthenticated exploitation with no user interaction - all factors that maximize accessibility. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends unauthenticated HTTP requests to the Razorpay for WooCommerce plugin's order-handling endpoint, substituting incrementing WooCommerce order IDs (which are sequential integers by default) in a user-controlled parameter. Because the plugin does not validate that the requesting session owns the referenced order, the attacker can reference arbitrary orders - potentially marking orders as paid, altering payment reference IDs, or triggering fulfillment for orders they did not legitimately complete. … |
| Remediation | No vendor-released patch version is identified in the available references - neither the Patchstack advisory nor EUVD-2026-60817 names a fixed version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Razorpay For Woocommerce
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today