{"id":"CVE-2026-104639","kind":"vulnerability","aliases":["CVE-2026-104639"],"related":[],"title":"Razorpay for WooCommerce plugin: webhook value enables SQL injection by administrators","description":"The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a value derived from an incoming webhook request before using it in a SQL query, allowing users able to obtain the webhook secret (administrators) to perform SQL injection attacks.","summary":"The Razorpay for WooCommerce WordPress plugin builds a SQL query from a value taken from an incoming webhook request without escaping it. A user who knows the webhook secret, which in practice means a site administrator, can inject SQL into that query and read or change the site database.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","razorpay","woocommerce","wordpress"],"not_affected_if":["plugin-4.8.9-or-later","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in WordPress admin under Plugins, or in `wp-content/plugins/razorpay/`.\n- Confirm whether the Razorpay for WooCommerce plugin is active on the site.","fix":"- Razorpay for WooCommerce WordPress plugin: move to `4.8.9` or later.","status":"open","published_at":"2026-11-08T06:17:04+00:00","first_seen_at":"2026-11-08T06:46:21+00:00","triaged_at":"2026-11-08T06:47:22+00:00","updated_at":"2026-11-08T06:47:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T06:47:22Z","model":"claude-haiku-5-5","output":{"fix":"- Razorpay for WooCommerce WordPress plugin: move to `4.8.9` or later.","reach":"internet","title":"Razorpay for WooCommerce plugin: webhook value enables SQL injection by administrators","impact":"high","summary":"The Razorpay for WooCommerce WordPress plugin builds a SQL query from a value taken from an incoming webhook request without escaping it. A user who knows the webhook secret, which in practice means a site administrator, can inject SQL into that query and read or change the site database.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","razorpay","php"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"database contents readable and modifiable through injected SQL","analyst_note":"Attack detail beyond the NVD description is not in the sources; exposure depends on whether the webhook path is reachable.","how_to_check":"- Check the installed plugin version in WordPress admin under Plugins, or in `wp-content/plugins/razorpay/`.\n- Confirm whether the Razorpay for WooCommerce plugin is active on the site.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-4.8.9-or-later"],"who_is_affected":"Sites running the Razorpay for WooCommerce WordPress plugin older than 4.8.9 that accept Razorpay webhooks. Exposure requires holding the webhook secret, so the realistic attacker is an administrator; sites without this plugin can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000748,"input_tokens":4544,"output_tokens":587,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-104639':14A,17A '-2026':13A,16A '4.8.9':79C 'abl':102C 'administr':11A,58B,108C 'allow':100C 'attack':113C 'build':29B 'chang':68B 'cve':12A,15A 'databas':71B 'deriv':87C 'enabl':7A 'escap':43B,84C 'incom':39B,90C 'inject':9A,60B,112C 'know':48B 'mean':55B 'obtain':104C 'packag':18B 'perform':110C 'php':19B 'plugin':4A,28B,77C 'practic':54B 'queri':32B,64B,99C 'razorpay':1A,20B,24B,73C 'read':66B 'request':41B,92C 'sanit':82C 'secret':51B,107C 'site':57B,70B 'sql':8A,31B,61B,98C,111C 'taken':36B 'use':94C 'user':46B,101C 'valu':6A,35B,86C 'webhook':5A,40B,50B,91C,106C 'without':42B 'woocommerc':3A,21B,26B,75C 'wordpress':22B,27B,76C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Razorpay for WooCommerce WordPress plugin older than 4.8.9 that accept Razorpay webhooks. Exposure requires holding the webhook secret, so the realistic attacker is an administrator; sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","php","razorpay","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-104639':14A,17A '-2026':13A,16A 'administr':11A 'cve':12A,15A 'enabl':7A 'inject':9A 'plugin':4A 'razorpay':1A 'sql':8A 'valu':6A 'webhook':5A 'woocommerc':3A","search_b":"'administr':58B 'build':29B 'chang':68B 'databas':71B 'escap':43B 'incom':39B 'inject':60B 'know':48B 'mean':55B 'packag':18B 'php':19B 'plugin':28B 'practic':54B 'queri':32B,64B 'razorpay':20B,24B 'read':66B 'request':41B 'secret':51B 'site':57B,70B 'sql':31B,61B 'taken':36B 'user':46B 'valu':35B 'webhook':40B,50B 'without':42B 'woocommerc':21B,26B 'wordpress':22B,27B","search_c":"'4.8.9':79C 'abl':102C 'administr':108C 'allow':100C 'attack':113C 'deriv':87C 'escap':84C 'incom':90C 'inject':112C 'obtain':104C 'perform':110C 'plugin':77C 'queri':99C 'razorpay':73C 'request':92C 'sanit':82C 'secret':107C 'sql':98C,111C 'use':94C 'user':101C 'valu':86C 'webhook':91C,106C 'woocommerc':75C 'wordpress':76C","cause_entry":null,"cause_path":null,"first_public_at":"2026-11-08T06:17:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104639","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104639","severity":null,"published_at":"2026-11-08T06:17:04+00:00","modified_at":"2026-11-08T06:17:04+00:00","first_seen_at":"2026-11-08T06:46:21+00:00","fetched_at":"2026-11-08T06:46:21+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}