Razorpay For Woocommerce
Monthly
Unauthenticated IDOR in the Razorpay for WooCommerce WordPress plugin (versions ≤ 4.8.7) allows remote attackers to manipulate order object references without any authentication, potentially bypassing payment authorization checks or modifying order state. Reported by Patchstack and corroborated by ENISA EUVD-2026-60817, this affects all WooCommerce stores running the vulnerable plugin versions with the Razorpay payment gateway active. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated network vector with low attack complexity means opportunistic abuse requires minimal skill.
Razorpay for WooCommerce plugin versions 4.8.2 and earlier allow unauthenticated attackers to bypass access controls through incorrectly configured authorization checks, enabling unauthorized modification of payment-related data. This missing authorization vulnerability affects all WooCommerce sites running the affected plugin and could allow attackers to manipulate sensitive payment information without authentication. The low EPSS score (0.02%, 4th percentile) and absence of active exploitation indicators suggest limited real-world attack activity despite the accessibility of the vulnerability vector (network, no authentication required).
Unauthenticated IDOR in the Razorpay for WooCommerce WordPress plugin (versions ≤ 4.8.7) allows remote attackers to manipulate order object references without any authentication, potentially bypassing payment authorization checks or modifying order state. Reported by Patchstack and corroborated by ENISA EUVD-2026-60817, this affects all WooCommerce stores running the vulnerable plugin versions with the Razorpay payment gateway active. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated network vector with low attack complexity means opportunistic abuse requires minimal skill.
Razorpay for WooCommerce plugin versions 4.8.2 and earlier allow unauthenticated attackers to bypass access controls through incorrectly configured authorization checks, enabling unauthorized modification of payment-related data. This missing authorization vulnerability affects all WooCommerce sites running the affected plugin and could allow attackers to manipulate sensitive payment information without authentication. The low EPSS score (0.02%, 4th percentile) and absence of active exploitation indicators suggest limited real-world attack activity despite the accessibility of the vulnerability vector (network, no authentication required).