medium5.3
CVE-2026-104118
The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowin…
Impact
The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders.
Affected products
| Product | Affected versions |
|---|---|
| Razorpay For WooCommerce WordPress Plugin | before 4.8.8 |
Versions were read from the advisory text. No structured product data has been published for this record yet.