CVE-2026-104338: Razorpay for WooCommerce < 4.8.9 - Unauthenticated User Context Switch via 1cc Coupon Route

Q: Which sites are exposed to this issue?

Sites using Razorpay for WooCommerce versions earlier than 4.8.9 are exposed only when the specific coupon required by the vulnerable route is active.

Q: Does an attacker need an account or other authorization?

No. The vulnerable REST route lacks an authorization check, so an unauthenticated attacker can invoke it and supply an arbitrary user identity for the request context.

Q: What can an attacker do through the vulnerable route?

They can cause processing of the affected request to run as an arbitrary user account for the duration of that request. The provided information does not establish effects beyond that request context.

Published Nov 8, 2026

Updated

The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not perform an authorization check on one of its REST routes and derives the acting user's identity from an unauthenticated request parameter, allowing an unauthenticated attacker to cause the request to execute as an arbitrary user account for the duration of the request. Exploitation additionally requires a specific coupon Razorpay for WooCommerce WordPress plugin before 4.8.9 to be active on the site.

Event History

Nov 8, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Which sites are exposed to this issue?

Sites using Razorpay for WooCommerce versions earlier than 4.8.9 are exposed only when the specific coupon required by the vulnerable route is active.

Does an attacker need an account or other authorization?

No. The vulnerable REST route lacks an authorization check, so an unauthenticated attacker can invoke it and supply an arbitrary user identity for the request context.

What can an attacker do through the vulnerable route?

They can cause processing of the affected request to run as an arbitrary user account for the duration of that request. The provided information does not establish effects beyond that request context.

CVE-2026-104338: Razorpay for WooCommerce < 4.8.9 - Unauthenticated User Context Switch via 1cc Coupon Route

Event History

Frequently Asked Questions

Which sites are exposed to this issue?

Does an attacker need an account or other authorization?

What can an attacker do through the vulnerable route?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to this issue?

Does an attacker need an account or other authorization?

What can an attacker do through the vulnerable route?