CVE-2026-104118 — Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDOR
The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated …
Published: 2026-10-04 · CVSS: 5.3 · CVSS 3.1
The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7