CVE-2026-104639
Razorpay for WooCommerce < 4.8.9 - Admin+ SQLi via Webhook
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a value derived from an incoming webhook request before using it in a SQL query, allowing users able to obtain the webhook secret (administrators) to perform SQL injection attacks.
What each source reports
CVE List No score
Razorpay for WooCommerce < 4.8.9 - Admin+ SQLi via Webhook
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a value derived from an incoming webhook request before using it in a SQL query, allowing users able to obtain the webhook secret (administrators) to perform SQL injection attacks.
- Record
CVE-2026-104639- Updated
- 2026-11-08
GitHub AdvisoriesGHSA-vj5w-qq84-5r93 No score
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a value...
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a value derived from an incoming webhook request before using it in a SQL query, allowing users able to obtain the webhook secret (administrators) to perform SQL injection attacks.
- Record
GHSA-vj5w-qq84-5r93- Updated
- 2026-11-08
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, references | GitHub Advisories | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-104639 is a vulnerability with no CVSS score yet in Unknown Razorpay For Woocommerce, published November 8, 2026. No source lists public exploit code. No source names a fixed version.