CVE-2026-16962: Tamara Checkout <= 1.9.9.20 - Unauthenticated Order Status Manipulation
The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its public payment cancel/fail return URLs, changing a WooCommerce order's status based solely on an attacker-supplied numeric order id, so an unauthenticated attacker can cancel or fail arbitrary orders store-wide by enumerating ids (triggering downstream stock-release and notification side-effects).
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit it. No WordPress account, WooCommerce permission, order key, or nonce is required.
What orders are at risk?
Arbitrary WooCommerce orders across the store may be targeted if an attacker can supply or enumerate their numeric order IDs. Successful requests can set orders to cancelled or failed.
What operational effects can exploitation cause?
Changing an order status can trigger downstream stock-release and notification side effects. This can disrupt fulfillment and generate customer or administrator notifications.
How can I determine whether my site is affected?
Sites using the Tamara Checkout WordPress plugin through version 1.9.9.20 are affected. Review WooCommerce order histories for unexpected cancellations or failures, particularly involving multiple or sequential order IDs.