Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Unknown | Razorpay for WooCommerce | unaffected |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Sun, 08 Nov 2026 08:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-89 |
Sun, 08 Nov 2026 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a value derived from an incoming webhook request before using it in a SQL query, allowing users able to obtain the webhook secret (administrators) to perform SQL injection attacks. | |
| Title | Razorpay for WooCommerce < 4.8.9 - Admin+ SQLi via Webhook | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-11-08T06:00:30.135Z
Reserved: 2026-10-02T05:25:44.941Z
Link: CVE-2026-104639
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-08T06:17:04.113
Modified: 2026-11-08T06:17:04.113
Link: CVE-2026-104639
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-08T08:00:12Z