Vulnerability record/PUBLISHED/Published Nov 8, 2026 06:00:30 UTC
CVE-2026-104639
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a value derived from an incoming webhook request before using it in a SQL query, allowing users able to obtain the webhook secret (administrators) to perform SQL injection attacks.
Base scoreN/A/ 10
SeverityNoneCVSS unscored
Exploitability / impact
CVSS metric breakdown
Base severityNone
No CVSS vector is available for this record.
CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedNov 8, 2026 06:00:30 UTC
PublishedNov 8, 2026 06:00:30 UTC
ReservedOct 2, 2026 05:25:44 UTC
Credits
- J4ck13Ch4n
- WPScan