CVE-2026-16962
Received Received - Intake

Unauthenticated Order Status Change in Tamara Checkout WordPress Plugin

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: WPScan

Description
The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its public payment cancel/fail return URLs, changing a WooCommerce order's status based solely on an attacker-supplied numeric order id, so an unauthenticated attacker can cancel or fail arbitrary orders store-wide by enumerating ids (triggering downstream stock-release and notification side-effects).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-16962
EUVD
EUVD-2026-63814

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tamara_checkout plugin to 1.9.9.20 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Tamara Checkout WordPress plugin up to version 1.9.9.20 has a flaw where it does not check authorization on public payment cancel or fail return URLs. This allows unauthenticated attackers to change the status of any WooCommerce order by providing a numeric order ID, enabling them to cancel or fail orders without permission.

Detection Guidance

Check if the Tamara Checkout WordPress plugin version is 1.9.9.20 or lower. Look for unauthorized order status changes in WooCommerce logs or database entries. Monitor network traffic for suspicious requests to payment cancel/fail URLs with numeric order IDs.

Impact Analysis

An attacker could cancel or fail any order on your store, leading to unintended stock releases and notifications. This disrupts normal operations and may cause financial or reputational harm due to incorrect order statuses.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized changes to order statuses, which may lead to improper handling of personal or financial data. Unauthorized cancellations or failures of orders could disrupt transaction records, affecting data integrity and audit trails required by these regulations.

Mitigation Strategies

Update the Tamara Checkout plugin to the latest version immediately. Disable the plugin if an update is unavailable. Review and restrict access to WooCommerce order management functions. Monitor order status changes for unauthorized activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16962. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart