A missing authorization flaw in the Razorpay for WooCommerce plugin allows an authenticated attacker or a user with an overly permissive role to bypass normal access controls and manipulate payment configuration settings. This can enable unauthorized transactions or financial manipulation, and the weakness is classified as a Broken Access Control failure (CWE‑862).

WordPress sites running Razorpay for WooCommerce version 4.8.2 or earlier are affected. Any installation of the plugin within this version range exposes the site to the vulnerability regardless of additional WordPress configuration or theme usage.

The CVSS score of 5.3 indicates medium severity; the flaw does not provide remote code execution but can compromise the integrity of payment processing. An EPSS score of less than 1% indicates current exploitation is rare, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through an authenticated session in the WooCommerce admin interface or via a misconfigured user role that grants unnecessary permissions to modify payment settings.