Description
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not verify ownership of an order before returning a coupon discount computed against that order, allowing unauthenticated attackers to disclose the monetary value of arbitrary customer orders by enumerating order IDs.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Razorpay for WooCommerce | < 4.8.9 | 4.8.9 |
References
- https://wpscan.com/vulnerability/d7806a06-2bce-4ebe-9c12-d5ac9a2dc416/ exploit vdb-entry technical-description