Description

Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-18T15:17:09.570Z",
  "pubdate": "2026-08-18T15:17:09.570Z",
  "executiveSummary": "An Insecure Direct Object Reference (IDOR) vulnerability exists in the Razorpay for WooCommerce plugin in versions less than or equal to 4.8.7. This security flaw is classified as unauthenticated, meaning that malicious actors do not require valid user credentials or session tokens to exploit the vulnerability. The root cause lies in the application's failure to properly authorize and validate requests referencing internal objects or transaction identifiers. Consequently, unauthorized remote attackers can manipulate direct object references to interact with sensitive endpoints, leading to unauthorized access, potential data disclosure, or unauthorized transaction manipulation.\nThe risk implications are severe for e-commerce platforms utilizing the affected versions, as successful exploitation can expose confidential customer data, order details, and payment metadata. Attackers can execute enumeration attacks against sequential or predictable object references to harvest sensitive information across multiple accounts without authentication. The primary exploitation requirement is network accessibility to the vulnerable WordPress instance hosting the Razorpay for WooCommerce plugin. Mitigating this risk requires immediate vendor patching and adherence to secure coding principles regarding access control enforcement and input validation.",
  "technicalDetails": "The vulnerability resides within the request handling logic of the Razorpay for WooCommerce plugin, specifically affecting versions <= 4.8.7. The core issue stems from an Insecure Direct Object Reference (IDOR) flaw where the application exposes internal implementation objects, such as order IDs or transaction references, without enforcing appropriate authorization checks or session validation.\nDuring standard operation, the plugin processes requests related to payment verification, order status retrieval, or checkout callbacks. However, the affected endpoints fail to verify whether the requesting entity possesses the necessary privileges or ownership rights to access the specified resource identifier. Because the vulnerability is unauthenticated, any remote attacker can directly invoke these endpoints over the network.\nThe attack flow proceeds as follows: First, the attacker identifies a vulnerable endpoint within the plugin that accepts a direct object reference parameter, such as an order ID or a database record identifier. Second, the attacker crafts an HTTP request targeting this endpoint, substituting the legitimate identifier with a targeted or sequentially generated value. Third, due to the absence of access control checks, the vulnerable component processes the request and returns the requested data or executes the associated logic.\nThe payload behavior involves supplying arbitrary or enumerated identifiers to the vulnerable parameter. Post-exploitation impact includes the unauthorized disclosure of sensitive customer transactions, Personally Identifiable Information (PII) associated with orders, and potential manipulation of payment verification states. The network exposure is public-facing, as the vulnerable WordPress REST API or AJAX endpoints are typically accessible via standard HTTP/HTTPS protocols without prior authentication challenges."
}