Is CVE-2026-57424 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57424 being exploited in the wild.

How severe is CVE-2026-57424?

Medium severity, with a CVSS score of 6.5, published 13 July 2026.

Which products and versions are affected?

Knit Pay Razorpay Payment Links for WooCommerce <= 2.1.4.

Is there a fix for CVE-2026-57424?

A patch was published on 2026-07-13: Version 2.1.5 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57424 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57424?

Check whether you run Knit Pay Razorpay Payment Links for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57424: knitpay Razorpay Payment Links for WooCommerce missing authorization

Q: Is there a fix for CVE-2026-57424?

A patch was published on 2026-07-13: Version 2.1.5 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-57424 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-57424?

Check whether you run Knit Pay Razorpay Payment Links for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57424 · Severity: medium · CVSS 6.5 · Published 2026-07-13

A security vulnerability exists in the Razorpay Payment Links plugin for WooCommerce, which is used by online stores to process customer payments. This flaw allows unauthorized individuals to bypass security checks and potentially perform actions they should not be allowed to, such as interfering with payment link configurations. This could lead to disruptions in the checkout process or unauthorized changes to how payments are handled on the site.

Vendors: Knit Pay.

Quick answers

Is CVE-2026-57424 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57424 being exploited in the wild.
How severe is CVE-2026-57424?: Medium severity, with a CVSS score of 6.5, published 13 July 2026.
Which products and versions are affected?: Knit Pay Razorpay Payment Links for WooCommerce <= 2.1.4.
Is there a fix for CVE-2026-57424?: A patch was published on 2026-07-13: Version 2.1.5 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57424 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57424?: Check whether you run Knit Pay Razorpay Payment Links for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Missing Authorization (CWE-862) vulnerability exists in the knitpay Razorpay Payment Links for WooCommerce (rzp-woocommerce) plugin through version 2.1.4. The flaw stems from insufficient access control checks on certain functions, allowing an unauthenticated remote attacker to execute actions that should be restricted to higher-privileged users. According to the CVSS vector, the attack is low complexity and requires no user interaction, potentially impacting the integrity and availability of the payment link system. The issue is addressed in version 2.1.5.

Affected products

knitpay Razorpay Payment Links for WooCommerce (rzp-woocommerce) <= 2.1.4

Timeline

2026-06-17: other: Reported by researcher dunvu0
2026-07-08: advisory: Patchstack advisory published
2026-07-13: disclosed: CVE published to NVD
2026-07-13: patched: Version 2.1.5 released to address the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.