Unauthenticated Order Value Disclosure in Razorpay for WooCommerce

Executive Summary

This vulnerability affects the Razorpay for WooCommerce plugin versions below 4.8.9. It allows unauthenticated attackers to disclose the monetary value of arbitrary customer orders by exploiting a flaw in the coupon application process. The issue arises because the plugin does not verify ownership of an order before applying a coupon discount, enabling attackers to enumerate order IDs and retrieve sensitive order data.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Razorpay for WooCommerce plugin version is below 4.8.9. You can do this by logging into your WordPress admin panel, navigating to Plugins, and checking the version of the Razorpay for WooCommerce plugin.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers can access the monetary value of customer orders by guessing order IDs. This exposes sensitive financial data of customers, potentially leading to privacy breaches or misuse of order details.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive customer financial data. GDPR requires protection of personal data, while HIPAA mandates safeguarding protected health information, both of which may be compromised here.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Razorpay for WooCommerce plugin to version 4.8.9 or higher. If updating is not possible, consider disabling the plugin temporarily until an update is applied.

Useful 0 Not Useful 0