The Razorpay for WooCommerce plugin versions prior to 4.8.8 lack proper ownership or authorization checks on a REST API route that is invoked during checkout. As a result, unauthenticated attackers can modify the shipping details stored on any order. The attacker can change addresses to redirect deliveries, potentially leading to fraud or loss of goods, and compromising customer privacy. This reflects an Insecure Direct Object Reference flaw (CWE-284).

Any WordPress site using the Razorpay for WooCommerce plugin with a version older than 4.8.8 is affected. The vulnerability is tied to the REST API endpoint used during the checkout process and is present in all installations of the plugin that have not been updated to the patched release.

Because the flaw permits unauthenticated modification, the attack vector is a simple HTTP request to the vulnerable REST endpoint. The attacker must know the order identifier, but no authentication or privilege escalation is needed. The CVSS score of 5.3 indicates moderate severity, and the EPSS score of < 1% suggests a low probability of real‑world exploitation. Even with no publicly reported exploits, the malicious use of this vulnerability can redirect shipments, lose goods, or violate privacy. The vulnerability is not listed in the CISA KEV catalog.