CVE-2026-16962: CWE-862 Missing Authorization in Tamara Checkout
Description
The Tamara Checkout WordPress plugin up to version 1.9.9.20 contains a missing authorization vulnerability. It does not verify order keys, nonces, or user capabilities on its public payment cancel/fail return URLs. This allows an unauthenticated attacker to change the status of arbitrary WooCommerce orders by supplying numeric order IDs, potentially causing order cancellations or failures and triggering related side effects such as stock release and notifications.
CVSS v3.1
Score 5.3medium
Affected software
Tamara Checkout
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-16962 is a missing authorization vulnerability (CWE-862) in the Tamara Checkout WordPress plugin versions up to 1.9.9.20. The plugin fails to verify the order key, nonce, or user capabilities on its public payment cancel/fail return URLs. As a result, an unauthenticated attacker can manipulate WooCommerce order statuses by enumerating numeric order IDs, causing orders to be canceled or marked as failed. This can lead to downstream effects including stock being released back to inventory and triggering notification mechanisms.
Potential Impact
An unauthenticated attacker can cancel or fail arbitrary WooCommerce orders across the store by exploiting the lack of authorization checks on payment cancel/fail URLs. This impacts order integrity and can disrupt business operations by releasing stock incorrectly and generating misleading notifications. There is no direct confidentiality or availability impact reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected URLs if possible or monitor for suspicious order status changes. Avoid relying on the plugin's public payment cancel/fail URLs for critical order status changes without additional authorization controls.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-24T08:16:11.470Z
- State
- PUBLISHED
Threat ID: 6a87eebfacd9273b49b49ebf
Added to database: 08/21/2026, 06:22:55 UTC
Last enriched: 09/11/2026, 03:18:55 UTC
Last updated: 10/05/2026, 18:48:17 UTC
Views: 59
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.