CVE-2026-74009

MediumCVSS 5.3

Published: 18/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

21th percentile - higher than 21% of all known CVEs

Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.

Unauthenticated attackers may access resources or data they should not, potentially leading to confidentiality and integrity breaches.

Upgrade the Razorpay for WooCommerce plugin to a version newer than 4.8.7 that includes a fix.

Original NVD description (English source)

Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.