CVE-2026-104118 Razorpay CVE debrief

Who should care

Defenders responsible for WordPress sites using the Razorpay for WooCommerce plugin should assess exposure and prioritize updating the plugin to version 4.8.8 or later.

Why it matters

CVE-2026-104118 allows unauthenticated attackers to modify shipping information on arbitrary orders due to missing ownership and authorization checks in the Razorpay for WooCommerce WordPress plugin. Defenders should prioritize verifying and updating the plugin, reviewing orders for suspicious activity, and monitoring for potential attacks.

• Unauthenticated attackers can modify shipping information on arbitrary orders
• Defenders must verify and update the plugin to prevent unauthorized modifications
• Reviewing orders for suspicious activity is necessary to detect potential attacks

Technical summary

The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders. The plugin's lack of checks enables attackers to make unauthorized modifications to order shipping information. This can lead to potential security breaches and financial losses. Defenders should prioritize verifying and updating the Razorpay for WooCommerce WordPress plugin to version 4.8.8 or later.

Defensive priority

Defenders should prioritize verifying and updating the Razorpay for WooCommerce WordPress plugin to version 4.8.8 or later, and review orders for potential unauthorized modifications.

Recommended defensive actions

• Verify and update the Razorpay for WooCommerce WordPress plugin to version 4.8.8 or later
• Review orders for potential unauthorized modifications
• Monitor for suspicious activity on the WordPress site

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the primary source being a WordPress plugin vulnerability report from WPScan.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.