{"affected":[{"defaultStatus":"unaffected","product":"Razorpay for WooCommerce","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"4.8.9","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-104639","cwes":["CWE-89"],"description":"The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a value derived from an incoming webhook request before using it in a SQL query, allowing users able to obtain the webhook secret (administrators) to perform SQL injection attacks.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/723a8b8f-1215-47a6-a6f7-7796ce38e7c1/"}],"kev":null,"metrics":[],"modifiedAt":1794117630135,"publishedAt":1794117630135,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/723a8b8f-1215-47a6-a6f7-7796ce38e7c1/"}],"remediation":[],"revision":"afcc9c69c5d29c36041fa69abaef2cedce24db1ba61304ede768ad89817901d3","sources":[{"modifiedAt":1794117630135,"name":"CNA: WPScan","retrievedAt":1794118105762,"url":"https://www.cve.org/CVERecord?id=CVE-2026-104639"}],"ssvc":null,"status":"published","title":"Razorpay for WooCommerce < 4.8.9 - Admin+ SQLi via Webhook","updatedAt":1794118105762}