Razorpay
Monthly
Unauthenticated IDOR in the Razorpay for WooCommerce WordPress plugin (versions ≤ 4.8.7) allows remote attackers to manipulate order object references without any authentication, potentially bypassing payment authorization checks or modifying order state. Reported by Patchstack and corroborated by ENISA EUVD-2026-60817, this affects all WooCommerce stores running the vulnerable plugin versions with the Razorpay payment gateway active. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated network vector with low attack complexity means opportunistic abuse requires minimal skill.
Razorpay for WooCommerce plugin versions 4.8.2 and earlier allow unauthenticated attackers to bypass access controls through incorrectly configured authorization checks, enabling unauthorized modification of payment-related data. This missing authorization vulnerability affects all WooCommerce sites running the affected plugin and could allow attackers to manipulate sensitive payment information without authentication. The low EPSS score (0.02%, 4th percentile) and absence of active exploitation indicators suggest limited real-world attack activity despite the accessibility of the vulnerability vector (network, no authentication required).
The Razorpay Payment Button Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Razorpay Payment Button Elementor Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated IDOR in the Razorpay for WooCommerce WordPress plugin (versions ≤ 4.8.7) allows remote attackers to manipulate order object references without any authentication, potentially bypassing payment authorization checks or modifying order state. Reported by Patchstack and corroborated by ENISA EUVD-2026-60817, this affects all WooCommerce stores running the vulnerable plugin versions with the Razorpay payment gateway active. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated network vector with low attack complexity means opportunistic abuse requires minimal skill.
Razorpay for WooCommerce plugin versions 4.8.2 and earlier allow unauthenticated attackers to bypass access controls through incorrectly configured authorization checks, enabling unauthorized modification of payment-related data. This missing authorization vulnerability affects all WooCommerce sites running the affected plugin and could allow attackers to manipulate sensitive payment information without authentication. The low EPSS score (0.02%, 4th percentile) and absence of active exploitation indicators suggest limited real-world attack activity despite the accessibility of the vulnerability vector (network, no authentication required).
The Razorpay Payment Button Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Razorpay Payment Button Elementor Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.