The Razorpay for WooCommerce plugin contains a missing authentication vulnerability (CWE-306) in the getCouponList() function due to the checkAuthCredentials() callback always returning true. This flaw allows unauthenticated attackers to modify billing and shipping contact details of any WooCommerce order by knowing or guessing the order ID. The vulnerability affects all versions up to and including 4.7.8. The CVSS 3.1 base score is 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

An attacker without authentication can modify the billing and shipping contact information (email and phone) of WooCommerce orders, potentially leading to order manipulation or fraud. There is no impact on confidentiality or availability. The integrity of order data is partially compromised.

Patch status is not yet confirmed — no official patch or vendor advisory is provided in the available data. Users should monitor the vendor's official channels for updates and apply any forthcoming patches promptly. Until a fix is available, restrict access to the WooCommerce order IDs and consider additional access controls or monitoring to detect unauthorized modifications.