CVE-2026-16962

The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its public payment cancel/fail return URLs, changing a WooCommerce order's status based solely on an attacker-supplied numeric order id, so an unauthenticated attacker can cancel or fail arbitrary orders store-wide by enumerating ids (triggering downstream stock-release and notification side-effects).

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://wpscan.com/vulnerability/e026c89e-83cc-452c-bfb9-2630f1ade284/

Configurations

No configuration.

History

26 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) El plugin de WordPress Tamara Checkout hasta la versión 1.9.9.20 no verifica la clave de pedido, un nonce, ni ninguna capacidad en sus URL públicas de retorno de cancelación/fallo de pago, cambiando el estado de un pedido de WooCommerce basándose únicamente en un ID de pedido numérico proporcionado por un atacante, por lo que un atacante no autenticado puede cancelar o fallar pedidos arbitrarios en toda la tienda enumerando los ID (desencadenando efectos secundarios de liberación de stock y notificación).

Information

Published : 2026-08-21 07:16

Updated : 2026-10-26 10:10

NVD link : CVE-2026-16962

Mitre link : CVE-2026-16962

CVE.ORG link : CVE-2026-16962

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-16962", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16962", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T12:49:37.960044Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "contact@wpscan.com", "affectedData": [{"vendor": "Unknown", "product": "Tamara Checkout", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.9.9.20"}], "defaultStatus": "unknown"}]}], "published": "2026-08-21T07:16:25.040", "references": [{"url": "https://wpscan.com/vulnerability/e026c89e-83cc-452c-bfb9-2630f1ade284/", "source": "contact@wpscan.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its public payment cancel/fail return URLs, changing a WooCommerce order's status based solely on an attacker-supplied numeric order id, so an unauthenticated attacker can cancel or fail arbitrary orders store-wide by enumerating ids (triggering downstream stock-release and notification side-effects)."}, {"lang": "es", "value": "El plugin de WordPress Tamara Checkout hasta la versi\u00f3n 1.9.9.20 no verifica la clave de pedido, un nonce, ni ninguna capacidad en sus URL p\u00fablicas de retorno de cancelaci\u00f3n/fallo de pago, cambiando el estado de un pedido de WooCommerce bas\u00e1ndose \u00fanicamente en un ID de pedido num\u00e9rico proporcionado por un atacante, por lo que un atacante no autenticado puede cancelar o fallar pedidos arbitrarios en toda la tienda enumerando los ID (desencadenando efectos secundarios de liberaci\u00f3n de stock y notificaci\u00f3n)."}], "lastModified": "2026-10-26T10:10:00.140", "sourceIdentifier": "contact@wpscan.com"}