CVE-2026-104338

{
  "etk_id": "ETK-2026-3881",
  "cve_id": "CVE-2026-104338",
  "display_id": "CVE-2026-104338",
  "ghsa_id": "GHSA-3g9w-x4v7-974v",
  "euvd_id": "EUVD-2026-119472",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization bypass in Razorpay for WooCommerce",
  "summary": "Razorpay for WooCommerce versions before 4.8.9 expose a REST route without the required authorization check. An unauthenticated attacker may cause requests to run in the context of another user during that request when the required coupon plugin is active.",
  "mitigation": "Update Razorpay for WooCommerce to version 4.8.9 or later. Until upgraded, disable the affected coupon plugin to reduce exposure.",
  "vendor": null,
  "product": "Razorpay for WooCommerce",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 4.8.9"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4.8.9"
      ],
      "package_name": "Razorpay for WooCommerce",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 21.04992185,
  "t0_at": "2026-11-08T06:00:29.959000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-08T07:18:28.648212+00:00",
      "days": 0.05415149550925926,
      "is_lower_bound": false,
      "measured_at": "2026-11-08T06:00:29.959000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-08T06:00:29.959000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-08T06:00:29.959000+00:00",
      "url": "https://github.com/advisories/GHSA-3g9w-x4v7-974v"
    }
  }
}