CVE-2026-39656

Vulnerability

Overview The Razorpay for WooCommerce plugin (woo-razorpay) versions up to and including 4.8.2 contain a missing authorization vulnerability [1]. The plugin fails to properly enforce access control security levels, meaning that certain functions or endpoints that should require higher-privileged user roles can be invoked without proper authentication or a nonce token check. This broken access control flaw stems from incorrectly configured security checks within the plugin's code.

Exploitation

Conditions An attacker does not need to be authenticated as a high-privilege user (such as an administrator) to exploit this vulnerability. The missing authorization allows any unauthenticated or low-privilege user to call functions that were intended for administrators or shop managers [1]. Because the plugin handles payment processing, the attack surface includes payment-related actions. The vulnerability can be exploited remotely over the network without requiring special access, making it suitable for mass exploitation campaigns targeting thousands of WordPress sites.

Impact

Successful exploitation could allow an attacker to perform actions normally restricted to higher roles—potentially altering payment settings, initiating unauthorized transactions, or accessing sensitive order/payment data. The lack of proper nonce checks further increases the risk of cross-site request forgery (CSRF) attacks, enabling attackers to trick authenticated administrators into unknowingly executing malicious actions. The CVSS v3 base score of 5.3 reflects a medium severity due to the low attack complexity and potential for unauthorized access, though the exact impact depends on the specific privileged functions exposed.

Mitigation

The vendor has addressed this issue in a patch released after version 4.8.2. Users are strongly advised to update the Razorpay for WooCommerce plugin to the latest available version [1]. For sites that cannot be updated immediately, contacting the hosting provider or a web developer for assistance is recommended to apply virtual patching or other mitigations. Given that such vulnerabilities are actively used in mass exploitation campaigns, timely updating is critical.