CVE-2026-74009
Received Received - Intake

Unauthenticated IDOR in Razorpay for WooCommerce

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: Patchstack

Description
Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-74009
EUVD
EUVD-2026-60817

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
patchstack woo_razorpay to 4.8.7 (inc)
razorpay woocommerce to 4.8.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Unauthenticated Insecure Direct Object References (IDOR) in the Razorpay for WooCommerce plugin versions 4.8.7 and below. IDOR allows unauthorized access to sensitive data or database interactions by bypassing authorization and authentication mechanisms. It is classified under OWASP Top 10's Broken Access Control (A1).

Detection Guidance

To detect this IDOR vulnerability in Razorpay for WooCommerce <= 4.8.7, inspect network traffic for unauthorized direct object references in API calls or form submissions. Check for unusual data access patterns or responses containing sensitive information without proper authentication. Review server logs for requests to restricted endpoints.

Impact Analysis

This vulnerability could allow malicious actors to access sensitive data or interact with the database without proper authorization. While the CVSS score of 5.3 indicates low severity, it still poses risks to data integrity and confidentiality. Users are advised to update the plugin or seek help from their hosting provider or web developer.

Mitigation Strategies

Immediately update the Razorpay for WooCommerce plugin to the latest version if available. If no patch exists, disable the plugin temporarily or restrict access via firewall rules. Consult your hosting provider or web developer for alternative mitigation strategies until an official fix is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74009. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart