WordPress Plugin Vulnerabilities

Razorpay for WooCommerce < 4.8.8 - Unauthenticated Insecure Direct Object Reference

Description

The Razorpay for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.8.7. This is due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
woo-razorpay
Fixed in 4.8.8

References

CVE
CVE-2026-74009
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/cfa48f93-867d-427b-9fb4-ced7b5427a8d

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Ananda Dhakal
Verified
No
WPVDB ID
a8bacbfb-1d3b-49b8-907d-1503d808d4d8

Timeline

Publicly Published
2026-08-17 (about 1 month ago)
Added
2026-09-10 (about 10 days ago)
Last Updated
2026-09-10 (about 10 days ago)

Other

Published
Title
Published
2026-08-17
Title
Eventin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR
Published
2025-05-08
Title
WPBookit < 1.0.3 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Email Update
Published
2026-06-17
Title
SupportCandy – Helpdesk & Customer Support Ticket System < 3.4.7 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2025-11-17
Title
Post Type Switcher < 4.0.1 - Insecure Direct Object Reference to Authenticated (Author+) Post Type Change
Published
2024-12-12
Title
Rate My Post – Star Rating Plugin by FeedbackWP < 4.2.5 - Unauthenticated Voting On Scheduled Posts