CVE-2026-104337 in for WooCommerce Plugin
Summary
by MITRE • 11/08/2026
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not verify ownership of an order before returning a coupon discount computed against that order, allowing unauthenticated attackers to disclose the monetary value of arbitrary customer orders by enumerating order IDs.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/08/2026
The vulnerability identified in versions of the Razorpay for WooCommerce WordPress plugin prior to 4.8.9 represents a critical failure in access control and business logic validation within an e-commerce payment integration context. This flaw stems from the application's inability to properly authenticate or authorize requests related to order-specific financial data, specifically coupon discount calculations. In secure web applications, any operation that retrieves sensitive information about a user’s transaction must verify that the requesting entity has legitimate ownership of that specific resource. However, in this instance, the plugin processes requests for computing discounts against arbitrary order identifiers without validating whether the requester is associated with or owns that particular order. This architectural oversight creates a direct pathway for unauthenticated attackers to interact with internal financial logic as if they were authorized users.
From a technical perspective, the core issue lies in the lack of server-side validation linking the request context to the specific order ID being queried. When an attacker submits a request containing a valid or guessed WooCommerce order identifier, the plugin proceeds to calculate and return the discount value associated with that order without checking session tokens, user roles, or ownership metadata. This behavior effectively bypasses standard authentication mechanisms because the endpoint does not require any form of login or token verification before executing the calculation logic. The vulnerability exploits the predictable nature of sequential database identifiers commonly used in WordPress installations, allowing attackers to iterate through a range of integer values to discover valid order IDs and subsequently extract financial details from each one.
The operational impact of this vulnerability is significant for both merchants and their customers. By enumerating order IDs and retrieving discount calculations, an attacker can infer the monetary value of arbitrary customer orders. While the direct disclosure might be limited to discount amounts rather than full transaction totals in some configurations, these figures often correlate closely with total purchase values or provide sufficient context to deduce sensitive financial information about specific transactions. This exposure compromises the confidentiality of customer data and violates privacy expectations inherent in e-commerce platforms. Furthermore, such enumeration capabilities can facilitate further attacks by revealing patterns in order volumes, pricing strategies, or high-value targets that could be leveraged for more sophisticated social engineering or targeted fraud attempts.
This vulnerability aligns with CWE-284 Improper Access Control, as the application fails to restrict access to resources based on user identity and permissions. It also maps closely to CWE-359 Exposure of Private Personal Information to an Unauthorized Actor, given that order details constitute personally identifiable information linked to financial transactions. In terms of offensive security frameworks, this behavior is consistent with ATT&CK technique T1078 Valid Accounts or more broadly T1046 Network Service Discovery when used in conjunction with enumeration techniques like T1592 Gather Victim Host Information, although the primary classification remains an access control failure leading to information disclosure. The lack of rate limiting on these endpoints further exacerbates the risk by allowing rapid iteration through potential order IDs without triggering security alerts or blocks.
To mitigate this vulnerability, immediate action is required to update the Razorpay for WooCommerce plugin to version 4.8.9 or later, where the developers have implemented proper ownership verification checks before returning any discount-related data. Administrators should ensure that all WordPress plugins are kept up-to-date with the latest security patches provided by their vendors. Additionally, implementing Web Application Firewall rules can help detect and block automated enumeration attempts targeting order endpoints. For organizations unable to patch immediately due to compatibility constraints, restricting access to WooCommerce REST API endpoints via IP whitelisting or requiring additional authentication layers for sensitive financial operations can provide temporary relief. Regular audits of plugin codebase for similar logic flaws are recommended to prevent recurrence in other modules that handle customer-specific data without adequate authorization checks.