CVE WATCH / VULNERABILITY DETAIL
CVE-2026-104337
UNKNOWNCVSS 0NVD feed
Published 8 November 2026 · tracked since 8 November 2026
Description
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not verify ownership of an order before returning a coupon discount computed against that order, allowing unauthenticated attackers to disclose the monetary value of arbitrary customer orders by enumerating order IDs.
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-104639
- CVE-2026-104338
- CVE-2026-104307
- CVE-2026-103375
- CVE-2026-103303
- CVE-2026-123613 MEDIUM 5.3
- CVE-2026-123612 LOW 2.3
- CVE-2026-123611 LOW 3.7
- CVE-2026-123610 LOW 3.7
- CVE-2026-123609 MEDIUM 4