The vulnerability in the Razorpay for WooCommerce plugin before version 4.8.9 arises from a missing authorization check on one of its REST routes. The plugin reads the acting user’s identity from an unauthenticated request parameter and then executes the request in that user’s context. Because the check is omitted, an attacker without any credentials can trigger the route and have the request run as an arbitrary WordPress user for the duration of the call.

All WordPress sites that use Razorpay for WooCommerce before version 4.8.9 are affected. The flaw is tied to the plugin’s 1cc coupon REST endpoint, which is publicly exposed through the WordPress REST API. An attacker must first ensure that a specific coupon is active in the plugin for the vulnerability to be exploitable.

The exploit is remote, requiring no prior authentication. Although no EPSS value is provided and the issue is not listed in CISA’s KEV catalog, the potential for arbitrary user execution makes the risk moderate to high. The likely attack vector is an unauthenticated HTTP request to the vulnerable REST route, allowing an attacker to perform actions such as placing orders or accessing sensitive data on behalf of a legitimate user during that single request.