critical · CVSS v3 9.8

CVE-2026-104338

The Razorpay for WooCommerce WordPress plugin (v<4.8.9) has a missing authorization check on a REST route. An unauthenticated attacker can t

Overview

The Razorpay for WooCommerce WordPress plugin (v<4.8.9) has a missing authorization check on a REST route. An unauthenticated attacker can trigger actions as any site user by supplying a request parameter, but only if a specific coupon is active. This flaw can lead to unauthorized account actions during the request.

Description

The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not perform an authorization check on one of its REST routes and derives the acting user's identity from an unauthenticated request parameter, allowing an unauthenticated attacker to cause the request to execute as an arbitrary user account for the duration of the request. Exploitation additionally requires a specific coupon Razorpay for WooCommerce WordPress plugin before 4.8.9 to be active on the site.

Impact

Confidentiality: attackers can impersonate users and potentially access sensitive data. Integrity: attackers can perform actions on behalf of users, such as modifying orders or applying coupons. Availability: not directly impacted. Site administrators and users are affected.

Remediation

Upgrade the Razorpay for WooCommerce WordPress plugin to version 4.8.9 or later. If an upgrade is not possible, disable the vulnerable REST route or block the specific coupon usage. Verify that all REST endpoints enforce proper authentication and authorization checks.

Risk context

Severity is critical with CVSS 9.8, indicating high risk. No EPSS data available. Immediate attention is recommended.

Affected products

  • Razorpay for WooCommerce WordPress plugin

Scores

Severity
critical
CVSS v2
7.5
CVSS v3
9.8
CVSS v4
—
EPSS
—

wordpress plugin authorization rest-api critical Razorpay WooCommerce

← All CVEs

Related CVEs

critical

CVE-2026-123595

Hickory DNS hickory-proto 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC3 handler, which matches the closest encloser by hash alone without checking the type bitmap and so accepts parent-side ancestor-delegation NSEC3 records as proof of nonexistence. An attacker who delivers one response built from genuinely signed parent NSEC3 records can cause NXDOMAIN or NODATA to be cached with AD=1, denying resolution of existing names at and below the zone cut.

View analysis

critical

CVE-2026-123596

Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC handler that accepts parent-side ancestor-delegation NSEC records as proof of nonexistence for names below the zone cut. An on-path attacker, rogue parent nameserver, or attacker winning a port and TXID race can deliver one forged NXDOMAIN response built from genuinely signed parent NSEC records, causing authenticated denial of existing child-zone names cached for the negative TTL.

View analysis

critical

CVE-2026-123605

Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because the validator verifies an RRSIG against the DNSKEY of whatever name appears in its Signer's Name field without checking that this name is the zone containing the RRset. Attackers controlling any secure zone can produce valid signatures over arbitrary records in unrelated zones, which resolvers, recursors, and clients using DnssecDnsHandle accept as authenticated.

View analysis

critical

CVE-2026-123614

Imgproxy versions 4.0.0 through 4.0.15 contain an integer overflow in the ICO loader that can be exploited via a crafted data_size value. The flaw leads to a heap buffer overflow, potentially crashing the process or allowing code execution. This vulnerability is critical and can be triggered remotely by submitting a malicious ICO image.

View analysis