The exposed getCouponList() function in Razorpay for WooCommerce enables an attacker to modify the billing and shipping contact information of any order without authentication. Because the permission callback always returns true, the plugin accepts unauthenticated requests, allowing any user who can guess or enumerate an order ID to tamper with that order’s details.

The vulnerability is present in all versions of the Razorpay for WooCommerce WordPress plugin up to and including 4.7.8. System administrators running these versions should verify the installed version and perform an upgrade or apply a patch.

The CVSS score of 5.3 indicates medium severity, and the current EPSS score of less than 1% signals a low exploitation probability. The flaw is not listed in the CISA KEV catalog, so it is likely not a widely exploited public exploit. Nevertheless, an attacker can still abuse the lack of authentication to alter order information, potentially leading to fraud or customer data compromise. As the weakness stems from missing authentication checks, it can be bounded by proper access control on the getCouponList() endpoint.