Unauthorized Data Modification in Razorpay for WooCommerce Plugin by WordPress

CVE-2025-14294

What is CVE-2025-14294?

The Razorpay for WooCommerce plugin for WordPress is exposed to vulnerabilities due to inadequate capability checks within the getCouponList() function across all versions up to and including 4.7.8. Specifically, the checkAuthCredentials() function consistently returns true, circumventing necessary authentication measures. Consequently, if an attacker knows or guesses an order ID, they can easily manipulate the billing and shipping contact details—such as the email and phone number—associated with WooCommerce orders, leading to potential data integrity issues and unauthorized access to sensitive information.

References