CVE-2026-39656

MediumCVSS 5.3

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

12th percentile - higher than 12% of all known CVEs

Summary

Missing Authorization vulnerability in Razorpay for WooCommerce up to version 4.8.2 allows exploiting incorrectly configured access control security levels.

Risk Assessment

Unauthorized users may gain access to administrative functions or data, potentially leading to integrity and confidentiality breaches.

Recommendation

Update the plugin to the latest version if available, or implement custom authorization mechanisms.

Original NVD description (English source)

Missing Authorization vulnerability in Razorpay Razorpay for WooCommerce woo-razorpay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Razorpay for WooCommerce: from n/a through <= 4.8.2.