CVE-2026-97299

Executive Summary

CVE-2026-97299 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability affecting the Razorpay Payment Links for WooCommerce plugin in versions up to and including 2.1.5. The flaw allows a remote attacker to induce a logged-in victim — typically a site administrator — to submit crafted requests that the vulnerable plugin processes without adequate anti-CSRF verification. Successful exploitation can result in unauthorized modification of plugin or site state, impacting integrity and availability with a low severity per the assigned CVSS score of 5.4.

Technical Analysis

This vulnerability is classified as CWE-352: Cross-Site Request Forgery. The root cause is the absence or inadequacy of anti-CSRF protections on a request-handling functionality exposed by the Razorpay Payment Links for WooCommerce plugin. Because the affected operations are reachable by unauthenticated requesters and rely solely on the victim's ambient authenticated browser session as the authorization mechanism, an attacker does not need credentials of their own. The vulnerability requires user interaction (UI:R) — the victim must be tricked into loading or submitting attacker-controlled content while authenticated to the WordPress/WooCommerce site. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L confirms network reachability, no privileges required, and low impact to both integrity and availability, with no confidentiality impact.

The specific vulnerable request handler, nonce/parameter names, and affected action are not disclosed in the available NVD description or CNA data. No code-level detail, function name, endpoint path, or parameter is provided, and therefore none can be stated without fabrication. The assessment must remain at the vulnerability-class level: a state-changing endpoint in the plugin accepts requests lacking a valid CSRF token, permitting cross-origin form submission or similar request forgery against an authenticated victim.

Exploitation Scenarios

No public proof-of-concept is available; the attack chain below is inferred strictly from the vulnerability class (CWE-352) and the CVSS metrics, without inventing endpoint or parameter specifics.

1. Reconnaissance / target identification: The attacker identifies WordPress sites running WooCommerce with the Razorpay Payment Links plugin at a vulnerable version (<= 2.1.5). Fingerprinting can be performed by inspecting publicly served plugin assets under the standard WordPress plugin directory path, or via search engines and internet-wide scanning services that index WordPress plugin versions.

2. Triggering the flaw: The attacker crafts a malicious page or email containing a forged request that targets a state-changing action exposed by the vulnerable plugin. Because the action lacks effective CSRF protection, the victim's already-authenticated session is sufficient to authorize the request when the victim's browser issues it.

3. Payload / execution method: The attacker lures an authenticated victim (for example, an administrator) to visit the crafted content or otherwise load the forged request. The victim's browser automatically attaches session credentials to the request, and the plugin processes it as legitimate. The user-interaction requirement (UI:R) means delivery depends on social engineering or similar inducement.

4. Post-exploitation impact: Consistent with the CVSS impact subscores (I:L, A:L, C:N), the attacker can cause limited unauthorized modification of plugin or related site state and limited disruption to availability — for example, altering configuration or triggering unintended state changes. No confidentiality impact is indicated. Because the plugin integrates with the Razorpay payment workflow, unauthorized changes to plugin state may disrupt payment-link behavior for the store.

Impact Assessment

The vulnerability has a CVSS v3.1 base score of 5.4 (Medium). Subscore analysis: Attack Vector Network (AV:N) means exploitation is possible remotely; Attack Complexity Low (AC:L) indicates no specialized conditions; Privileges Required None (PR:N) confirms the attacker needs no account; User Interaction Required (UI:R) means a victim must be induced to act; Scope Unchanged (S:U) means impact is confined to the vulnerable component. Impact is Integrity:L and Availability:L, with Confidentiality:N.

The blast radius is limited to WordPress/WooCommerce sites running the affected plugin version. Business impact centers on integrity and availability of the e-commerce storefront: unauthorized state changes to the payment-link integration could misdirect or disrupt payment flows, damage customer trust, and require administrative remediation. The absence of a patch (0/4 patch confidence) and the absence of a vendor fix or documented workaround raise the residual risk and prolong exposure for unmitigated deployments.

Detection Guidance

Sigma Rule

title: Cross-Site Request Forgery Against Razorpay Payment Links for WooCommerce
id: 8f4c2b71-5a9e-4d33-9c1a-razorpay2csr
status: experimental
description: Detects potential CSRF exploitation attempts targeting actions handled by the Razorpay Payment Links for WooCommerce plugin (CVE-2026-97299).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97299
author: valtersit.com
logsource:
  product: webserver
  service: http
detection:
  selection_uri:
    cs-uri-query|contains:
      - 'razorpay'
  selection_method:
    cs-method:
      - 'POST'
      - 'GET'
  selection_missing_token:
    # Requests to state-changing plugin actions lacking a CSRF nonce
    cs-uri-query|not_contains:
      - '_wpnonce'
      - 'nonce'
  condition: selection_uri and selection_method and selection_missing_token
fields:
  - c-ip
  - cs-uri
  - cs-method
  - cs-referer
falsepositives:
  - Legitimate plugin requests that use an alternate token parameter name
level: medium
tags:
  - attack.t1190
  - cve.2026.97299

YARA Rule

rule CVE_2026_97299_CSRF_Razorpay_WooCommerce
{
    meta:
        description = "Detects indicators of CSRF exploitation attempts against Razorpay Payment Links for WooCommerce plugin (CVE-2026-97299)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97299"
        date = "2026-01-01"
        cve = "CVE-2026-97299"

    strings:
        $plugin = "razorpay-payment-links" ascii wide nocase
        $wc     = "woocommerce" ascii wide nocase
        $razor  = "razorpay" ascii wide nocase

    condition:
        any of ($plugin) or (all of ($wc) and any of ($razor))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-97299 Possible CSRF attempt targeting Razorpay Payment Links for WooCommerce"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"razorpay"; nocase; http.uri; content:"!nonce"; nocase; reference:cve,2026-97299; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-97299; classtype:web-application-attack; sid:202697299; rev:1;)

Elastic Detection

sequence by host.id, user.name with maxspan=5m
  [ network where network.protocol == "http" and
      http.request.method == "POST" and
      stringContains(http.request.uri, "razorpay") ]

Splunk SPL Query

index=web sourcetype=access_combined
| where cs_method=POST AND like(uri_query, "%razorpay%") AND NOT (like(uri_query, "%nonce%") OR like(uri_query, "%_wpnonce%"))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, uri_query, referer
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,csrf,">
  <rule id="100299" level="10">
    <decoded_as>web-log</decoded_as>
    <match>razorpay</match>
    <regex>POST|GET</regex>
    <description>CVE-2026-97299: Possible CSRF request targeting Razorpay Payment Links for WooCommerce from $(srcip)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_97299,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or official workaround is currently tracked.

1. Immediate mitigations:

• Add or enforce anti-CSRF tokens (nonces) on any state-changing request handler exposed by the plugin at the web-application-firewall or reverse-proxy layer where feasible.
• Deploy WAF rules to reject cross-origin POST requests to plugin actions that lack a valid CSRF token and to enforce same-origin referer checks.
• Restrict administrative browsing: instruct administrators to log out of privileged sessions when not in use and to avoid visiting untrusted links while authenticated.
• Consider temporarily disabling the plugin if the payment-link functionality is not business-critical until a fix is available.

2. Patch / upgrade steps:

• Monitor the vendor's release channel and the NVD entry for CVE-2026-97299 for an updated plugin version beyond 2.1.5.
• Once a patched version is published, update the plugin through the WordPress admin or WP-CLI and verify the installed version exceeds 2.1.5.
• Re-test affected functionality after upgrade to confirm CSRF protection is effective.

3. Long-term hardening:

• Adopt a plugin vulnerability-management process that tracks CVEs for all WordPress/WooCommerce extensions and enforces timely patching.
• Apply least-privilege principles to WordPress roles and enforce strong session hygiene.
• Maintain a WAF and enable security logging/alerting for plugin-related request anomalies.

References

• NVD — CVE-2026-97299: https://nvd.nist.gov/vuln/detail/CVE-2026-97299
• CWE-352: Cross-Site Request Forgery (CSRF): https://cwe.mitre.org/data/definitions/352.html
• CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
• WordPress Plugin Security Best Practices: https://developer.wordpress.org/plugins/security/
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

No exploit-in-the-wild evidence, PoC, or known threat actor campaign is associated with CVE-2026-97299 at the time of reporting. CISA KEV listing: NO.