{"id":"CVE-2026-104337","kind":"vulnerability","aliases":["CVE-2026-104337"],"related":[],"title":"Razorpay for WooCommerce: order totals readable by enumerating order IDs","description":"The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not verify ownership of an order before returning a coupon discount computed against that order, allowing unauthenticated attackers to disclose the monetary value of arbitrary customer orders by enumerating order IDs.","summary":"The Razorpay for WooCommerce WordPress plugin before 4.8.9 returns a coupon discount computed against an order without checking who owns that order. An unauthenticated attacker can enumerate order IDs and learn the monetary value of other customers' orders.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-commerce","other","razorpay","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","plugin-upgraded"],"how_to_check":"- Check the installed version of the Razorpay for WooCommerce plugin in the WordPress admin under Plugins; a version below `4.8.9` is affected.\n- Look for the plugin's coupon or order endpoints being reachable without login on the public site.","fix":"- Razorpay for WooCommerce: upgrade to `4.8.9` or later.","status":"open","published_at":"2026-11-08T06:17:03+00:00","first_seen_at":"2026-11-08T06:46:21+00:00","triaged_at":"2026-11-08T06:47:27+00:00","updated_at":"2026-11-08T06:47:27+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-08T06:47:27Z","model":"claude-haiku-5-5","output":{"fix":"- Razorpay for WooCommerce: upgrade to `4.8.9` or later.","reach":"internet","title":"Razorpay for WooCommerce: order totals readable by enumerating order IDs","impact":"low","summary":"The Razorpay for WooCommerce WordPress plugin before 4.8.9 returns a coupon discount computed against an order without checking who owns that order. An unauthenticated attacker can enumerate order IDs and learn the monetary value of other customers' orders.","audience":"businesses","category":"other","nicknames":[],"who_cares":["woocommerce","wordpress","razorpay","e-commerce"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attackers read monetary totals of other customers' orders","analyst_note":"","how_to_check":"- Check the installed version of the Razorpay for WooCommerce plugin in the WordPress admin under Plugins; a version below `4.8.9` is affected.\n- Look for the plugin's coupon or order endpoints being reachable without login on the public site.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-upgraded","plugin-not-installed"],"who_is_affected":"Stores running the Razorpay for WooCommerce WordPress plugin older than 4.8.9 are exposed, since the coupon endpoint answers requests without an ownership check. Sites that do not use this plugin, or that have upgraded to 4.8.9 or later, can skip it. The sources do not say whether the flaw is reachable on every store configuration.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000743,"input_tokens":4545,"output_tokens":577,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-104337':13A,16A '-2026':12A,15A '4.8.9':31B,69C 'allow':86C 'arbitrari':95C 'attack':48B,88C 'check':41B 'commerc':19B 'comput':36B,82C 'coupon':34B,80C 'custom':60B,96C 'cve':11A,14A 'disclos':90C 'discount':35B,81C 'e':18B 'e-commerc':17B 'enumer':8A,50B,99C 'id':10A,52B,101C 'learn':54B 'monetari':56B,92C 'order':4A,9A,39B,45B,51B,61B,76C,85C,97C,100C 'own':43B 'ownership':73C 'plugin':29B,67C 'razorpay':1A,21B,25B,63C 'readabl':6A 'return':32B,78C 'total':5A 'unauthent':47B,87C 'valu':57B,93C 'verifi':72C 'without':40B 'woocommerc':3A,22B,27B,65C 'wordpress':23B,28B,66C","nicknames":[],"mitigations":[],"who_affected":"Stores running the Razorpay for WooCommerce WordPress plugin older than 4.8.9 are exposed, since the coupon endpoint answers requests without an ownership check. Sites that do not use this plugin, or that have upgraded to 4.8.9 or later, can skip it. The sources do not say whether the flaw is reachable on every store configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ecommerce","low","other","razorpay","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-104337':13A,16A '-2026':12A,15A 'cve':11A,14A 'enumer':8A 'id':10A 'order':4A,9A 'razorpay':1A 'readabl':6A 'total':5A 'woocommerc':3A","search_b":"'4.8.9':31B 'attack':48B 'check':41B 'commerc':19B 'comput':36B 'coupon':34B 'custom':60B 'discount':35B 'e':18B 'e-commerc':17B 'enumer':50B 'id':52B 'learn':54B 'monetari':56B 'order':39B,45B,51B,61B 'own':43B 'plugin':29B 'razorpay':21B,25B 'return':32B 'unauthent':47B 'valu':57B 'without':40B 'woocommerc':22B,27B 'wordpress':23B,28B","search_c":"'4.8.9':69C 'allow':86C 'arbitrari':95C 'attack':88C 'comput':82C 'coupon':80C 'custom':96C 'disclos':90C 'discount':81C 'enumer':99C 'id':101C 'monetari':92C 'order':76C,85C,97C,100C 'ownership':73C 'plugin':67C 'razorpay':63C 'return':78C 'unauthent':87C 'valu':93C 'verifi':72C 'woocommerc':65C 'wordpress':66C","cause_entry":null,"cause_path":null,"first_public_at":"2026-11-08T06:17:03+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104337","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104337","severity":null,"published_at":"2026-11-08T06:17:03+00:00","modified_at":"2026-11-08T06:17:03+00:00","first_seen_at":"2026-11-08T06:46:21+00:00","fetched_at":"2026-11-08T06:46:21+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}