CVE-2026-104118 in for WooCommerce Plugin
Summary
by MITRE • 10/04/2026
The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/04/2026
The vulnerability identified in versions of the Razorpay for WooCommerce WordPress plugin prior to version 4.8.8 represents a critical failure in access control mechanisms within the application's REST API implementation. This flaw specifically affects the checkout process, where sensitive order data is manipulated. The core technical issue stems from the absence of proper ownership verification and authorization checks on specific endpoints responsible for updating shipping details during transaction processing. In secure software architecture, any endpoint that modifies stateful data associated with a user or an entity must verify that the requesting actor has legitimate authority over that entity. In this case, the plugin fails to validate whether the authenticated user initiating the request is the actual owner of the order being modified. This oversight allows for unauthorized modification of critical transactional information without requiring valid credentials tied to the specific order in question.
From a technical perspective, this vulnerability aligns with CWE-284, which describes Improper Access Control, and more specifically relates to CWE-639 regarding Authorization Bypass Through User-Controlled Key. The REST API route intended for updating shipping information does not adequately scope the request context to ensure that only authorized parties can alter these fields. Consequently, an unauthenticated attacker or a malicious actor with minimal access privileges can exploit this logic flaw by crafting specific HTTP requests targeting the vulnerable endpoint. By manipulating parameters such as order identifiers within the payload, the attacker can bypass standard security boundaries and inject arbitrary shipping data into existing orders. This type of attack does not require complex exploitation techniques but relies on the fundamental lack of server-side validation regarding entity ownership during state-changing operations.
The operational impact of this vulnerability is significant for both merchants and customers relying on the WooCommerce platform integrated with Razorpay payments. An attacker can alter shipping addresses, potentially redirecting physical goods to fraudulent locations or causing logistical failures that disrupt business operations. Beyond direct financial loss from misdirected shipments, there are substantial implications for data integrity and customer trust. If sensitive address information is modified without authorization, it may indicate a broader compromise of the order management system, leading to potential privacy violations under regulations such as GDPR if personal identifiable information is exposed or mishandled during these unauthorized modifications. Furthermore, this vulnerability could be leveraged in conjunction with other attacks to facilitate fraud, where an attacker modifies shipping details after payment has been authorized but before fulfillment occurs, complicating dispute resolution and recovery efforts for merchants.
To mitigate this risk, immediate action must be taken by updating the Razorpay for WooCommerce plugin to version 4.8.8 or later, which addresses these authorization gaps through enhanced validation logic. In addition to patching, administrators should implement strict input validation on all REST API endpoints that modify order data, ensuring that every request includes and verifies a valid session token linked directly to the specific resource being accessed. It is also advisable to review server-side logs for any anomalous activity involving shipping address updates outside of normal checkout flows. For organizations seeking deeper security posture improvements, adopting principles outlined in the OWASP API Security Top 10, particularly those related to broken object level authorization, will help prevent similar vulnerabilities from arising in future development cycles. Regular penetration testing focusing on REST API endpoints is recommended to identify and remediate access control weaknesses before they can be exploited by malicious actors seeking to disrupt e-commerce operations or steal goods.