Razorpay for WooCommerce <= 4.7.8 - Missing Authentication to Unauthenticated Order Modification
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
The Razorpay for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the getCouponList() function in all versions up to, and including, 4.7.8. This is due to the checkAuthCredentials() permission callback always returning true, providing no actual authentication. This makes it possible for unauthenticated attackers to modify the billing and shipping contact information (email and phone) of any WooCommerce order by knowing or guessing the order ID.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-14294
- 2026-10-03 Alias added: GHSA-67hm-gm63-c6j6
References
Other 5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/163d42df-148f-431c-891e-dbdc09bf2ae1?source=cve
- https://plugins.trac.wordpress.org/browser/woo-razorpay/trunk/includes/api/auth.php#L7
- https://plugins.trac.wordpress.org/browser/woo-razorpay/trunk/includes/api/api.php#L33
- https://plugins.trac.wordpress.org/browser/woo-razorpay/trunk/includes/api/coupon-get.php#L58
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3436262%40woo-razorpay&new=3436262%40woo-razorpay&sfp_email=&sfph_mail=
More Razorpay vulnerabilities
- TI-2026-73439 Server-side request forgery in Razorpay IFSC Ruby gem via IFSC lookup CVSS 4.0MEDIUM 6.9
- TI-2026-82488 Cross-site scripting in Razorpay Payment Button Elementor plugin for WordPress CVSS 3.1HIGH 7.1
- TI-2026-63364 WordPress Razorpay Payment Button plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
- TI-2026-51999 WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability CVSS 3.1MEDIUM 5.3
- TI-2026-28627 WordPress Razorpay for WooCommerce plugin <= 4.8.2 - Broken Access Control vulnerability CVSS 3.1MEDIUM 5.3
- TI-2024-10059 Razorpay Payment Button <= 2.4.6 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
Sources
- CVE-2025-14294 · CVE Program
- CVE-2025-14294 · NVD
- FIRST EPSS
- GHSA-67hm-gm63-c6j6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences