The Razorpay for WooCommerce plugin, before version 4.8.9, fails to confirm that a requester owns an order before calculating and returning the discount from a 1CC coupon. This missing authorization check allows any unauthenticated user to submit a request with an arbitrary order ID and obtain the monetary value of that order. The disclosed data is limited to the coupon‑derived amount.

All installations of the Razorpay for WooCommerce WordPress plugin that are running a version earlier than 4.8.9 are vulnerable. The affected product is the Razorpay for WooCommerce plugin for WordPress; no other vendors or products are listed.

The vulnerability is not a code‑execution flaw; it grants data disclosure only. No CVSS score is published, and the EPSS score is not available, so the objective risk metrics are undefined. However, because the flaw permits unauthenticated requests and requires only enumeration of existing order identifiers, the likelihood of exploitation is high in environments where order IDs are guessable or can be obtained via HTTP response patterns. The vulnerability is not listed in the CISA KEV catalog, indicating no public proof‑of‑concept exploits are known at this time.