{"affected":[{"defaultStatus":"unaffected","product":"Razorpay for WooCommerce","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"4.8.9","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-104337","cwes":["CWE-200"],"description":"The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not verify ownership of an order before returning a coupon discount computed against that order, allowing unauthenticated attackers to disclose the monetary value of arbitrary customer orders by enumerating order IDs.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/d7806a06-2bce-4ebe-9c12-d5ac9a2dc416/"}],"kev":null,"metrics":[],"modifiedAt":1794117629788,"publishedAt":1794117629788,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/d7806a06-2bce-4ebe-9c12-d5ac9a2dc416/"}],"remediation":[],"revision":"929921f840b5ee8697d3ea1918118c327f1b3727a913a110955fcb12ca96475a","sources":[{"modifiedAt":1794117629788,"name":"CNA: WPScan","retrievedAt":1794118103557,"url":"https://www.cve.org/CVERecord?id=CVE-2026-104337"}],"ssvc":null,"status":"published","title":"Razorpay for WooCommerce < 4.8.9 - Unauthenticated Order Data Disclosure via 1CC Coupon Apply","updatedAt":1794118103557}