CVE-2026-104337: Razorpay for WooCommerce < 4.8.9 - Unauthenticated Order Data Disclosure via 1CC Coupon Apply

Q: Who can exploit this issue, and what access do they need?

An unauthenticated attacker can exploit it. They do not need to own the targeted order, because the affected plugin does not verify order ownership before returning the coupon discount calculation.

Q: What information can be exposed?

An attacker can disclose the monetary value of arbitrary customer orders by enumerating order IDs. The described exposure is limited to order-value information returned through the 1CC coupon-apply functionality.

Q: How can I determine whether my site is affected?

A site is affected if it uses Razorpay for WooCommerce at a version earlier than 4.8.9. The vulnerable behavior is reachable through the 1CC coupon-apply flow when order ownership is not verified.

Q: What should be done if updating cannot happen immediately?

The provided information does not identify a workaround. Reducing or disabling access to the affected 1CC coupon-apply functionality, if operationally possible, would limit exposure, but the documented fix boundary is upgrading to 4.8.9 or later.

Published Nov 8, 2026

Updated

The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not verify ownership of an order before returning a coupon discount computed against that order, allowing unauthenticated attackers to disclose the monetary value of arbitrary customer orders by enumerating order IDs.

Event History

Nov 8, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue, and what access do they need?

An unauthenticated attacker can exploit it. They do not need to own the targeted order, because the affected plugin does not verify order ownership before returning the coupon discount calculation.

What information can be exposed?

An attacker can disclose the monetary value of arbitrary customer orders by enumerating order IDs. The described exposure is limited to order-value information returned through the 1CC coupon-apply functionality.

How can I determine whether my site is affected?

A site is affected if it uses Razorpay for WooCommerce at a version earlier than 4.8.9. The vulnerable behavior is reachable through the 1CC coupon-apply flow when order ownership is not verified.

What should be done if updating cannot happen immediately?

The provided information does not identify a workaround. Reducing or disabling access to the affected 1CC coupon-apply functionality, if operationally possible, would limit exposure, but the documented fix boundary is upgrading to 4.8.9 or later.

CVE-2026-104337: Razorpay for WooCommerce < 4.8.9 - Unauthenticated Order Data Disclosure via 1CC Coupon Apply

Event History

Frequently Asked Questions

Who can exploit this issue, and what access do they need?

What information can be exposed?

How can I determine whether my site is affected?

What should be done if updating cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue, and what access do they need?

What information can be exposed?

How can I determine whether my site is affected?

What should be done if updating cannot happen immediately?