CVE-2026-104337
Razorpay for WooCommerce < 4.8.9 - Unauthenticated Order Data Disclosure via 1CC Coupon Apply
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not verify ownership of an order before returning a coupon discount computed against that order, allowing unauthenticated attackers to disclose the monetary value of arbitrary customer orders by enumerating order IDs.
What each source reports
CVE List No score
Razorpay for WooCommerce < 4.8.9 - Unauthenticated Order Data Disclosure via 1CC Coupon Apply
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not verify ownership of an order before returning a coupon discount computed against that order, allowing unauthenticated attackers to disclose the monetary value of arbitrary customer orders by enumerating order IDs.
- Record
CVE-2026-104337- Updated
- 2026-11-08
GitHub AdvisoriesGHSA-6vqr-9fh5-xmwj No score
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not verify ownership of an order...
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not verify ownership of an order before returning a coupon discount computed against that order, allowing unauthenticated attackers to disclose the monetary value of arbitrary customer orders by enumerating order IDs.
- Record
GHSA-6vqr-9fh5-xmwj- Updated
- 2026-11-08
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, references | GitHub Advisories | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-104337 is a vulnerability with no CVSS score yet in Unknown Razorpay For Woocommerce, published November 8, 2026. No source lists public exploit code. No source names a fixed version.