Threats tagged 'ghsa-6vqr-9fh5-xmwj'

A vulnerability in the Razorpay for WooCommerce WordPress plugin versions before 4.8.9 allows unauthenticated attackers to enumerate order IDs and disclose the monetary value of arbitrary customer orders. This occurs because the plugin does not verify ownership of an order before returning a coupon discount computed against that order.