Reference page — cumulative record through Thursday, October 8, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-104118
Unknown Razorpay for WooCommerce — Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDOR
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N U N L N 5.3 .0018 7.1 —
AFFECTED
Product Versions Fixed
Razorpay for WooCommerce unspecified —
TIMELINE
Oct 1 Reserved by WPScan
Oct 4 Published (CNA: WPScan)
Oct 5 EXPLOIT PUBLISHED — CVE-2026-104118 (Unknown Razorpay for WooCommerce). Public exploit reference added.
Description
The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| October 1, 2026 | Reserved | Reserved by WPScan |
| October 4, 2026 | Published | Published (CNA: WPScan) |
| October 5, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-104118 (Unknown Razorpay for WooCommerce). Public exploit reference added. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Unknown | Razorpay for WooCommerce | — | — | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-104118 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Thursday, October 8, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
