Authorization Bypass in Razorpay WooCommerce Plugin Affects WordPress Sites
CVE-2026-104338
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 8 November 2026
Badges
What is CVE-2026-104338?
The Razorpay for WooCommerce plugin for WordPress, prior to version 4.8.9, has a significant security flaw that allows unauthorized users to bypass authorization checks on specific REST routes. This vulnerability enables attackers to exploit the plugin by executing requests as different user accounts based on unauthenticated request parameters. To successfully carry out the attack, an active coupon associated with the plugin is required. This highlights the importance of promptly updating to the latest version to mitigate potential security risks.
Affected Version(s)
Razorpay for WooCommerce 0 < 4.8.9
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.