What the vulnerability does
01Description
The Razorpay for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the getCouponList() function in all versions up to, and including, 4.7.8. This is due to the checkAuthCredentials() permission callback always returning true, providing no actual authentication. This makes it possible for unauthenticated attackers to modify the billing and shipping contact information (email and phone) of any WooCommerce order by knowing or guessing the order ID.
Explanation of Vulnerability in Simple Terms
02Summary
Razorpay for WooCommerce versions 4.7.8 and earlier contain a missing authentication control that allows an attacker to modify data without logging in. The vulnerability affects the integrity of information processed by the payment gateway integration. Site administrators should update to a version newer than 4.7.8 to remediate this issue.
What an attacker can do
03Attacker Capabilities
Modify data in the payment gateway integration without authentication.
Potential impact on your site
04Site Impact
Attackers can alter payment-related data or settings without authorization, potentially affecting transactions.
Conditions required to exploit
05Prerequisites
Network access to the WooCommerce site; no login or user interaction required.
Key dates
06Disclosure timeline
February 19, 2026
CVE published
April 8, 2026
Record updated
