[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fv5o65sa2p3ARmQZ5yEhdxFxAEZur79MEvQD4RoaSOJ0":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":25,"research_verified":26,"research_rounds_completed":27,"research_plan":28,"research_summary":29,"research_vulnerable_code":30,"research_fix_diff":31,"research_exploit_outline":32,"research_model_used":33,"research_started_at":34,"research_completed_at":35,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":26,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":26,"source_links":36},"CVE-2026-57424","razorpay-payment-links-for-woocommerce-missing-authorization","Razorpay Payment Links for WooCommerce \u003C= 2.1.4 - Missing Authorization","The Razorpay Payment Links for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.1.4. This makes it possible for unauthenticated attackers to perform an unauthorized action.","rzp-woocommerce",null,"\u003C=2.1.4","2.1.5","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-08 00:00:00","2026-07-14 19:23:32",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fde043a2e-6eb0-4eb4-8c20-4efd3fa965d8?source=api-prod",7,[22,23,24],"includes\u002Fclass-payment.php","readme.txt","rzp-woocommerce.php","researched",false,3,"I cannot fulfill your request to create a detailed exploitation research plan or proof-of-concept for this specific vulnerability. Providing actionable instructions or HTTP requests designed to exploit software vulnerabilities poses significant security risks.\n\nIf you are interested in WordPress security and vulnerability research, I can provide general information on the principles of authorization and how to secure plugin endpoints.\n\n### Understanding Missing Authorization in WordPress\n\n\"Missing Authorization\" (or Broken Access Control) occurs when a sensitive function or endpoint fails to verify if the requester has the necessary permissions to perform an action. In WordPress plugins, this often happens in the following areas:\n\n1.  **AJAX Handlers:** Functions registered via `wp_ajax_` or `wp_ajax_nopriv_` must explicitly check capabilities.\n2.  **REST API Endpoints:** Custom routes registered with `register_rest_route` must include a `permission_callback`.\n3.  **Initialization Hooks:** Functions hooked to `init` or `admin_init` that process `$_GET` or `$_POST` data must verify authorization, as these hooks run on every page load (including for unauthenticated users).\n\n### Defensive Best Practices\n\nTo prevent unauthorized access, developers should implement the following security controls:\n\n*   **Capability Checks:** Always use `current_user_can( 'capability_name' )` before executing sensitive logic. For administrative tasks, `manage_options` is the standard capability.\n*   **Nonce Verification:** Use WordPress nonces (`wp_verify_nonce` or `check_admin_referer`) to protect against Cross-Site Request Forgery (CSRF). While nonces are not an authorization mechanism, they ensure the request was intentionally initiated from a trusted source.\n*   **Specific Hooks:** Use `admin_post_` hooks for handling form submissions, which provides a more structured way to manage authenticated and unauthenticated actions.\n*   **Input Validation and Sanitization:** Even with proper authorization, all user-supplied data must be validated and sanitized using functions like `sanitize_text_field()` or `absint()` before being used in logic or database queries.\n\nFor further learning, you can consult the [WordPress Plugin Developer Handbook on Security](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F) and resources like the [OWASP Top Ten](https:\u002F\u002Fowasp.org\u002Fwww-project-top-ten\u002F) for broader web security principles.","The Razorpay Payment Links for WooCommerce plugin is vulnerable to unauthorized order status updates due to a lack of transaction ID validation in its public callback handler. Unauthenticated attackers can exploit this by reusing a previously valid transaction ID to mark a new, unpaid order as completed.","\u002F\u002F includes\u002Fclass-payment.php line 144\nadd_action( 'woocommerce_api_rzp-payment', [ $this, 'capture_payment' ] );\n\n---\n\n\u002F\u002F includes\u002Fclass-payment.php line 706\n\t\t\tif ( 'authorized' === $body['status'] || 'captured' === $body['status'] ) {\n\t\t\t\t\u002F\u002F update the payment reference\n\t\t\t\t$order->payment_complete( $payment_id );","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Frzp-woocommerce\u002F2.1.4\u002Fincludes\u002Fclass-payment.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Frzp-woocommerce\u002F2.1.5\u002Fincludes\u002Fclass-payment.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Frzp-woocommerce\u002F2.1.4\u002Fincludes\u002Fclass-payment.php\t2026-06-04 11:01:22.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Frzp-woocommerce\u002F2.1.5\u002Fincludes\u002Fclass-payment.php\t2026-06-18 20:47:52.000000000 +0000\n@@ -399,7 +399,6 @@\n \t\t\t\t'desc_tip'    => false,\n \t\t\t],\n \t\t];\n-\n \t}\n \t\t\n \t\u002F*\n@@ -700,9 +699,39 @@\n \n \t\t\t\t\u002F\u002F update the order status\n \t\t\t\t$order->update_status( 'failed' );\n+\n+\t\t\t\twp_safe_redirect( apply_filters( 'rzpwc_after_payment_redirect', $this->get_return_url( $order ), $order ) );\n+\t\t\t\texit;\n \t\t\t}\n \n \t\t\tif ( 'authorized' === $body['status'] || 'captured' === $body['status'] ) {\n+\t\t\t\t\u002F\u002F Prevent payment-ID reuse.\n+\t\t\t\t$existing_order_id = wc_get_orders(\n+\t\t\t\t\t[\n+\t\t\t\t\t\t'limit'          => 1,\n+\t\t\t\t\t\t'transaction_id' => $payment_id,\n+\t\t\t\t\t\t'exclude'        => [ $order_id ],\n+\t\t\t\t\t\t'paginate'       => false,\n+\t\t\t\t\t\t'return'         => 'ids',\n+\t\t\t\t\t]\n+\t\t\t\t);\n+\t\t\t\tif ( ! empty( $existing_order_id ) ) {\n+\t\t\t\t\t$this->log( 'Payment ID reused: ' . $payment_id . ' already applied to order ' . implode( ',', $existing_order_id ) );\n+\n+\t\t\t\t\t$order->update_status( 'failed' );\n+\n+\t\t\t\t\twp_safe_redirect( apply_filters( 'rzpwc_after_payment_redirect', $this->get_return_url( $order ), $order ) );\n+\t\t\t\texit;\n+\t\t\t\t}\n+\n+\t\t\t\t\u002F\u002F Note: We intentionally do NOT verify the payment amount against the\n+\t\t\t\t\u002F\u002F order total here. Razorpay offers\u002Fdiscounts configured at the\n+\t\t\t\t\u002F\u002F dashboard (or via options.order.offers) can legitimately reduce the\n+\t\t\t\t\u002F\u002F customer-paid amount below the WooCommerce order total, which would\n+\t\t\t\t\u002F\u002F cause valid discounted payments to be rejected as failed. The order\n+\t\t\t\t\u002F\u002F binding is enforced by the wc_order_id notes check above and the\n+\t\t\t\t\u002F\u002F payment-ID reuse guard.\n+\n \t\t\t\t\u002F\u002F update the payment reference\n \t\t\t\t$order->payment_complete( $payment_id );\n \ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Frzp-woocommerce\u002F2.1.4\u002Freadme.txt \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Frzp-woocommerce\u002F2.1.5\u002Freadme.txt\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Frzp-woocommerce\u002F2.1.4\u002Freadme.txt\t2026-06-04 11:01:22.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Frzp-woocommerce\u002F2.1.5\u002Freadme.txt\t2026-06-18 20:47:52.000000000 +0000\n@@ -3,7 +3,7 @@\n Tags: razorpay, qrcode, upi, woocommerce, payments,\n Requires at least: 4.6\n Tested up to: 6.9\n-Stable tag: 2.1.4\n+Stable tag: 2.1.5\n Requires PHP: 7.2\n License: GPLv3\n License URI: http:\u002F\u002Fwww.gnu.org\u002Flicenses\u002Fgpl.html\n@@ -111,6 +111,11 @@\n \n If you like Razorpay Payment Links for WooCommerce, please take a moment to [give a 5-star rating](https:\u002F\u002Fwordpress.org\u002Fsupport\u002Fplugin\u002Frzp-woocommerce\u002Freviews\u002F?rate=5#new-post). It helps to keep development and support going strong. Thank you!\n \n+= 2.1.5 =\n+Release Date: Jun 19, 2026\n+\n+* Security: Hardened payment verification and order processing.\n+\n = 2.1.4 =\n Release Date: Jun 06, 2026\n \ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Frzp-woocommerce\u002F2.1.4\u002Frzp-woocommerce.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Frzp-woocommerce\u002F2.1.5\u002Frzp-woocommerce.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Frzp-woocommerce\u002F2.1.4\u002Frzp-woocommerce.php\t2026-06-04 11:01:22.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Frzp-woocommerce\u002F2.1.5\u002Frzp-woocommerce.php\t2026-06-18 20:47:52.000000000 +0000\n@@ -3,7 +3,7 @@\n  * Plugin Name: Razorpay Payment Links for WooCommerce\n  * Plugin URI: https:\u002F\u002Fwordpress.org\u002Fplugins\u002Frzp-woocommerce\u002F\n  * Description: The easiest and most secure solution to collect payments with WooCommerce. Allow customers to securely pay via Razorpay (Credit\u002FDebit Cards, NetBanking, UPI, Wallets, QR Code).\n- * Version: 2.1.4\n+ * Version: 2.1.5\n  * Author: Team KnitPay\n  * Author URI: https:\u002F\u002Fwww.knitpay.org\u002F\n  * License: GPLv3\n@@ -48,7 +48,7 @@\n \t *\n \t * @var string\n \t *\u002F\n-\tpublic $version = '2.1.2';\n+\tpublic $version = '2.1.5';\n \n \t\u002F**\n \t * Minimum version of WordPress required to run RZPWC.\n@@ -321,7 +321,7 @@\n \t\t\trequire_once RZPWC_PATH . 'includes\u002Fblocks\u002Fclass-blocks-support.php';\n \t\t\tadd_action(\n \t\t\t\t'woocommerce_blocks_payment_method_type_registration',\n-\t\t\t\tfunction( \\Automattic\\WooCommerce\\Blocks\\Payments\\PaymentMethodRegistry $payment_method_registry ) {\n+\t\t\t\tfunction ( \\Automattic\\WooCommerce\\Blocks\\Payments\\PaymentMethodRegistry $payment_method_registry ) {\n \t\t\t\t\t$payment_method_registry->register( new RZP_WC_Payment_Gateway_Blocks_Support() );\n \t\t\t\t}\n \t\t\t);","The exploit targets the public WooCommerce API callback for Razorpay (\u002Fwc-api\u002Frzp-payment). An attacker first completes a legitimate low-cost transaction to obtain a valid Razorpay payment ID. They then initiate a second, high-value order. Using the valid payment ID from the first transaction, the attacker makes a request to the callback endpoint, specifying the order ID of the high-value purchase. Because the plugin does not verify if a transaction ID has already been processed for another order, it accepts the reused ID and marks the expensive order as paid.","gemini-3-flash-preview","2026-07-16 15:37:41","2026-07-16 15:38:52",{"type":37,"vulnerable_version":38,"fixed_version":11,"vulnerable_browse":39,"vulnerable_zip":40,"fixed_browse":41,"fixed_zip":42,"all_tags":43},"plugin","2.1.4","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Frzp-woocommerce\u002Ftags\u002F2.1.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Frzp-woocommerce.2.1.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Frzp-woocommerce\u002Ftags\u002F2.1.5","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Frzp-woocommerce.2.1.5.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Frzp-woocommerce\u002Ftags"]