CVE WATCH / VULNERABILITY DETAIL
CVE-2026-104639
UNKNOWNCVSS 0NVD feed
Published 8 November 2026 · tracked since 8 November 2026
Description
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a value derived from an incoming webhook request before using it in a SQL query, allowing users able to obtain the webhook secret (administrators) to perform SQL injection attacks.
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-104338
- CVE-2026-104337
- CVE-2026-104307
- CVE-2026-103375
- CVE-2026-103303
- CVE-2026-123613 MEDIUM 5.3
- CVE-2026-123612 LOW 2.3
- CVE-2026-123611 LOW 3.7
- CVE-2026-123610 LOW 3.7
- CVE-2026-123609 MEDIUM 4