WordPress Plugin Vulnerabilities

Razorpay for WooCommerce < 4.5.7 - Transfers Manipulation via CSRF

Description

The plugin does not have CSRF checks when updating, creating and reversing transfers, which could allow attackers to make logged in admins perform such actions via CSRF attacks

Affects Plugins

Plugin icon
woo-razorpay
Fixed in 4.5.7

References

URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/e6a2b2f6-c648-4755-be24-92c7f287813e

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Verified
No
WPVDB ID
e32a90a7-67ef-4454-91b9-49e54d63814f

Timeline

Publicly Published
2023-11-28 (about 2 years ago)
Added
2024-01-29 (about 2 years ago)
Last Updated
2024-01-29 (about 2 years ago)

Other

Published
Title
Published
2023-01-04
Title
My Calendar < 3.3.25 - Event/Location Deletion via CSRF
Published
2024-12-11
Title
dejure.org Vernetzungsfunktion < 1.98.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2025-10-21
Title
PowerPress Podcasting < 11.14 - Cross-Site Request Forgery
Published
2026-05-11
Title
WP-Redirection <= 1.0.3 - Cross-Site Request Forgery to Settings Update
Published
2024-04-10
Title
EWWW Image Optimizer < 7.3.0 - Cross-Site Request Forgery