Razorpay for WooCommerce <= 4.7.8 - प्रमाणीकरण की कमी के कारण अनधिकृत ऑर्डर संशोधन

The core of the vulnerability lies in a missing capability check within the getCouponList() function. This function, responsible for retrieving coupon lists, lacks proper authentication, causing the checkAuthCredentials() permission callback to always return true. Consequently, any unauthenticated attacker who knows or can guess an order ID can manipulate the order's contact details. This could lead to fraudulent transactions, account takeovers, or the injection of malicious data into the WooCommerce system. The potential blast radius is significant, as it impacts all orders within the affected WooCommerce store.

WooCommerce stores utilizing the Razorpay for WooCommerce plugin, particularly those running versions 0.0.0 through 4.7.8, are at risk. Shared hosting environments where plugin access is less controlled are especially vulnerable, as attackers may be able to exploit the vulnerability without direct access to the server.

• wordpress / composer / npm:

grep -r 'checkAuthCredentials' /var/www/html/wp-content/plugins/razorpay-for-woocommerce/

• wordpress / composer / npm:

wp plugin list --status=all | grep razorpay

• generic web:

curl -I https://your-wordpress-site.com/wp-json/razorpay/v1/coupons?order_id=123 # Replace 123 with a valid order ID

1. 2026-02-19Disclosure

   disclosure

1. आरक्षित2025-12-08
2. प्रकाशित2026-02-19
3. संशोधित2026-04-08
4. EPSS अद्यतन2026-03-23

The primary mitigation is to immediately upgrade the Razorpay for WooCommerce plugin to version 4.7.9 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a temporary workaround by restricting access to the getCouponList() endpoint through a web application firewall (WAF) or proxy server. Specifically, block requests to this endpoint from unauthenticated users. Additionally, review WooCommerce order data for any suspicious modifications. After upgrading, confirm the fix by attempting to access the getCouponList() endpoint without authentication and verifying that access is denied.

सक्रिय इंस्टॉलेशन

100Kज्ञात

प्लगइन रेटिंग