CVE-2026-97299

The Razorpay Payment Links for WooCommerce plugin in versions up to and including 2.1.5 is vulnerable to Cross Site Request Forgery (CSRF) without requiring authentication. An unauthenticated attacker can force a victim to perform unwanted actions.

An attacker can trick a logged-in user into performing unauthorized operations, potentially leading to unwanted configuration changes or transactions.

Update the Razorpay Payment Links for WooCommerce plugin to a version later than 2.1.5 to remove the CSRF vulnerability.