The Razorpay for WooCommerce plugin fails to sanitize a value taken from an incoming webhook request before using it in a SQL statement. This deficiency allows an attacker who can obtain the webhook secret—typically an administrator—to inject arbitrary SQL. The vulnerability can lead to database compromise, including data disclosure, modification, or deletion, and may enable escalation to complete system takeover if the database includes other sensitive information.

WordPress plugins identified as Razorpay for WooCommerce before version 4.8.9 are affected. No other products or vendors are listed.

The exploit requires possession of the webhook secret, which is generally limited to administrative accounts. The CVSS score is not provided, and the EPSS score is unavailable, so the exact attack likelihood cannot be quantified. The vulnerability is not currently listed in the CISA KEV catalog. Because the attack vector relies on a pre‑arranged admin credential, the risk is significant for sites that expose the webhook endpoint while leaving the secret in an unprotected or easily accessible place.