CVE WATCH / VULNERABILITY DETAIL
CVE-2026-104338
UNKNOWNCVSS 0NVD feed
Published 8 November 2026 · tracked since 8 November 2026
Description
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not perform an authorization check on one of its REST routes and derives the acting user's identity from an unauthenticated request parameter, allowing an unauthenticated attacker to cause the request to execute as an arbitrary user acc
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-104639
- CVE-2026-104337
- CVE-2026-104307
- CVE-2026-103375
- CVE-2026-103303
- CVE-2026-123613 MEDIUM 5.3
- CVE-2026-123612 LOW 2.3
- CVE-2026-123611 LOW 3.7
- CVE-2026-123610 LOW 3.7
- CVE-2026-123609 MEDIUM 4