Threats tagged 'ghsa-3g9w-x4v7-974v'

The Razorpay for WooCommerce WordPress plugin versions prior to 4.8.9 contain a vulnerability where one of its REST routes lacks proper authorization checks. This flaw allows an unauthenticated attacker to impersonate an arbitrary user account for the duration of the request by manipulating an unauthenticated request parameter. Exploitation requires the presence of a specific coupon feature in the plugin.