Missing Authorization in Razorpay Payment Links for WooCommerce

Executive Summary

CVE-2026-57424 is a Broken Access Control vulnerability in the WordPress Razorpay Payment Links for WooCommerce Plugin, versions 2.1.4 and below.

This vulnerability occurs due to missing authorization, authentication, or nonce token checks, which allows unauthenticated users to perform actions that should require higher privileges.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability involves checking if your WooCommerce site is running a vulnerable version of the Razorpay Payment Links for WooCommerce plugin (version 2.1.4 or below). Since the issue is related to missing authorization checks, you can verify the plugin version and inspect its behavior for unauthorized access.

• Check the installed version of the Razorpay Payment Links for WooCommerce plugin. Navigate to the WordPress admin dashboard, go to 'Plugins', and look for the plugin version. If it is 2.1.4 or below, the system is vulnerable.
• Use WP-CLI to check the plugin version from the command line. Run the following command: wp plugin list --name=rzp-woocommerce --fields=name,version,status
• Inspect the plugin files for missing authorization checks. Look for endpoints or functions that lack proper access control, authentication, or nonce token validation. This may require reviewing the plugin's source code or using security scanning tools like Patchstack or Wordfence.
• Use a vulnerability scanner that supports WordPress plugins, such as WPScan, to detect the presence of this CVE. Run the following command: wpscan --url yourwebsite.com --enumerate vp

If you are a Patchstack user, enable auto-updates for vulnerable plugins to ensure you receive the patched version (2.1.5 or later) automatically.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows unauthenticated users to perform higher-privileged actions, potentially leading to unauthorized operations within the WooCommerce payment system.

However, the threat impact is considered low and it is unlikely to be exploited.

Users are advised to update to version 2.1.5 or later to mitigate this issue.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability involves a missing authorization check, which could lead to unauthorized access or actions by unauthenticated users. This may impact compliance with standards and regulations in the following ways:

• GDPR (General Data Protection Regulation): If the vulnerability allows unauthorized access to personal data processed by the WooCommerce plugin, it could result in a data breach. GDPR requires strict access controls and protection of personal data, and failure to implement proper authorization may lead to non-compliance, potential fines, or legal consequences.
• HIPAA (Health Insurance Portability and Accountability Act): If the affected plugin is used in a healthcare-related context where protected health information (PHI) is processed, the missing authorization could expose PHI to unauthorized parties. HIPAA mandates strict access controls and safeguards for PHI, and this vulnerability may violate those requirements.
• PCI DSS (Payment Card Industry Data Security Standard): If the plugin handles payment card data, the vulnerability could compromise the security of cardholder data. PCI DSS requires proper access controls and authentication mechanisms to protect such data, and this issue may lead to non-compliance.

While the CVSS score of 6.5 indicates a medium severity, the specific impact on compliance depends on the nature of the data and systems involved. Organizations should assess whether the vulnerability exposes sensitive data or violates specific regulatory requirements.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the vulnerability in Razorpay Payment Links for WooCommerce Plugin versions 2.1.4 and below, users should immediately update the plugin to version 2.1.5 or later.

Alternatively, users can seek assistance from their hosting provider or developer to apply the necessary patches.

Patchstack users have the option to enable auto-updates for vulnerable plugins to ensure timely patching.

Useful 0 Not Useful 0