Vulnerability record/PUBLISHED/Published Nov 8, 2026 06:00:29 UTC
CVE-2026-104337
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not verify ownership of an order before returning a coupon discount computed against that order, allowing unauthenticated attackers to disclose the monetary value of arbitrary customer orders by enumerating order IDs.
Base scoreN/A/ 10
SeverityNoneCVSS unscored
Exploitability / impact
CVSS metric breakdown
Base severityNone
No CVSS vector is available for this record.
CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedNov 8, 2026 06:00:29 UTC
PublishedNov 8, 2026 06:00:29 UTC
ReservedOct 1, 2026 20:08:53 UTC
Credits
- Xanlar Agamalizade
- WPScan