CVE-2026-104639: Razorpay for WooCommerce < 4.8.9 - Admin+ SQLi via Webhook

Q: Who can exploit this issue?

Exploitation requires obtaining the webhook secret. The available information identifies administrators as the users able to obtain that secret.

Q: What must an attacker be able to send to trigger the SQL injection?

They need to submit an incoming webhook request containing a value derived from the webhook request that reaches the vulnerable SQL query. The plugin does not sanitize and escape that value before using it.

Q: Which plugin versions are affected?

Versions of Razorpay for WooCommerce before 4.8.9 are affected.

Published Nov 8, 2026

Updated

The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a value derived from an incoming webhook request before using it in a SQL query, allowing users able to obtain the webhook secret (administrators) to perform SQL injection attacks.

Event History

Nov 8, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Exploitation requires obtaining the webhook secret. The available information identifies administrators as the users able to obtain that secret.

What must an attacker be able to send to trigger the SQL injection?

They need to submit an incoming webhook request containing a value derived from the webhook request that reaches the vulnerable SQL query. The plugin does not sanitize and escape that value before using it.

Which plugin versions are affected?

Versions of Razorpay for WooCommerce before 4.8.9 are affected.

CVE-2026-104639: Razorpay for WooCommerce < 4.8.9 - Admin+ SQLi via Webhook

Event History

Frequently Asked Questions

Who can exploit this issue?

What must an attacker be able to send to trigger the SQL injection?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What must an attacker be able to send to trigger the SQL injection?

Which plugin versions are affected?