Description
The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Razorpay for WooCommerce | < 4.8.8 | 4.8.8 |
References
- https://wpscan.com/vulnerability/d94ebc87-c404-4b30-8291-26c4bc2eb63b/ exploit vdb-entry technical-description