CVE-2026-104118

CVE-2026-104118: Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDOR

Vendor Unknown
Product Razorpay for WooCommerce
Published October 4, 2026
Last update October 4, 2026
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders.

Key dates

02Disclosure timeline

October 4, 2026 CVE published